xmrig | 430619792908a03e12fd30feba49949be822bdc451b08d429da212089c8c6dcf

Analysis

max time kernel
35s
max time network
32s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
Size

1.9MB
MD5

0b171985920af2fda9671dc9fa001f0b
SHA1

c86adab385805c4e06ad39df7c1edc368ef3131b
SHA256

430619792908a03e12fd30feba49949be822bdc451b08d429da212089c8c6dcf
SHA512

a39cb884dc4a9ac46dd14bed995b2694b9d9472812a6b5632f2abe44682822cd433ffa75b0c0587c70cbd0998bbd360241de69ffe57964760493a977e99e3c02
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlBE:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2372-219-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/3024-218-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2700-217-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2604-216-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2672-212-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2204-210-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2116-198-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2820-107-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/3068-66-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3068	WdCwjyY.exe
2820	gChupWw.exe
2116	gPpidKY.exe
2204	uNCAoIW.exe
2672	SGeRYDi.exe
2604	qqOlJNU.exe
2700	HkEiwaL.exe
3024	gnPFqFB.exe
2712	zCwVJgW.exe
2588	qlsmsNg.exe
2500	WGwvzrr.exe
2760	EzWoGLg.exe
2692	wwkKmwv.exe
2732	DWpguRG.exe
2484	mHNyGjL.exe
2540	etieeVb.exe
2972	ISPmqxt.exe
2928	docrvta.exe
952	tdGVYLO.exe
2440	qTWhCNZ.exe
2192	ixygULo.exe
320	MgBePWb.exe
2452	vhWCbxH.exe
1348	KzqKtGF.exe
1856	jRmXROv.exe
2312	Coacxjy.exe
1720	znGeDpR.exe
1760	AgtJsVU.exe
692	ChZbVRU.exe
576	olTfwdC.exe
2436	aHfRsTQ.exe
1304	OYsPXzc.exe
2840	fJIqjtG.exe
1480	ssEqBPZ.exe
1204	SihtSht.exe
1936	KEnxZYg.exe
1676	aVqzUub.exe
1164	Xzgtugw.exe
2148	eTATNfz.exe
816	YKGensZ.exe
268	VjQsrMe.exe
584	vPgKLCW.exe
1120	dNRPMnu.exe
1084	vlXHEIH.exe
1940	OecdFHB.exe
2308	eYqDcau.exe
2864	MOjxlgk.exe
2428	lBCJVuW.exe
1580	gnwkHOH.exe
1636	rFXcptj.exe
2088	wHlGluT.exe
2872	skaxIdP.exe
1600	diKFMiO.exe
2744	nFfNXaG.exe
2412	exSTvJI.exe
2904	LUjpeGk.exe
2640	ZlofsLJ.exe
1644	CxSFwVd.exe
796	YgkJxPV.exe
1544	MIfsteq.exe
1548	thlyqYA.exe
1188	KvFCouw.exe
1640	HwvwVtb.exe
2304	eLuKdwM.exe

Loads dropped DLL 64 IoCs

pid	Process
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-1-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0009000000015c78-6.dat	upx
behavioral1/files/0x0008000000015cce-10.dat	upx
behavioral1/files/0x0006000000016a29-85.dat	upx
behavioral1/files/0x0006000000015f01-108.dat	upx
behavioral1/files/0x00060000000165ae-168.dat	upx
behavioral1/files/0x0006000000017371-166.dat	upx
behavioral1/files/0x0006000000016fed-160.dat	upx
behavioral1/files/0x0006000000016e24-153.dat	upx
behavioral1/files/0x0006000000016c04-149.dat	upx
behavioral1/files/0x0006000000016be2-148.dat	upx
behavioral1/files/0x0006000000016d57-150.dat	upx
behavioral1/files/0x0006000000016d3e-136.dat	upx
behavioral1/files/0x000600000001735a-163.dat	upx
behavioral1/files/0x0006000000016e4a-156.dat	upx
behavioral1/memory/3024-218-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2700-217-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2604-216-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2672-212-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2204-210-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2116-198-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x0006000000016d16-130.dat	upx
behavioral1/files/0x0006000000016176-125.dat	upx
behavioral1/files/0x0006000000016cbe-122.dat	upx
behavioral1/files/0x0006000000016ca5-116.dat	upx
behavioral1/files/0x0006000000016c51-110.dat	upx
behavioral1/files/0x0006000000015f7a-97.dat	upx
behavioral1/files/0x0006000000015df1-95.dat	upx
behavioral1/files/0x0006000000016bfb-91.dat	upx
behavioral1/files/0x00060000000167d5-147.dat	upx
behavioral1/files/0x000600000001650c-146.dat	upx
behavioral1/files/0x0006000000016287-145.dat	upx
behavioral1/files/0x0006000000016448-143.dat	upx
behavioral1/files/0x0006000000016d51-140.dat	upx
behavioral1/files/0x0006000000016d1a-133.dat	upx
behavioral1/files/0x0006000000016cc6-126.dat	upx
behavioral1/files/0x0006000000016cb6-119.dat	upx
behavioral1/files/0x0006000000016c7c-113.dat	upx
behavioral1/files/0x00060000000160af-109.dat	upx
behavioral1/memory/2820-107-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x0007000000015d31-84.dat	upx
behavioral1/files/0x0009000000015d1a-70.dat	upx
behavioral1/files/0x0007000000015d98-39.dat	upx
behavioral1/files/0x0007000000015d27-32.dat	upx
behavioral1/files/0x0009000000015d07-24.dat	upx
behavioral1/files/0x0007000000015cf6-17.dat	upx
behavioral1/memory/3068-66-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x000b000000015605-13.dat	upx
behavioral1/files/0x000a000000015cfe-50.dat	upx
behavioral1/files/0x0007000000015cee-31.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xedmrOS.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\tMjPTAo.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\IVDtrCB.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\FfknMAu.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\IErfuxl.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\IRixSxZ.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ORFABCr.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ZWGuYtm.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\wdsZSrl.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\AweRdyn.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\HOdhKgG.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ISwjaen.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\xTEllYX.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ZtzjSKU.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ZLaoAPZ.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\MZJraDF.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\RelFMsN.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\uuEnYlL.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\FLhjCax.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\xlauJNV.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\gnPFqFB.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\kbfaxDB.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\hfxsASi.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\MxVdAFX.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\afQHVxZ.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\PWVPbdC.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\UAXigeu.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\tXNQJnk.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\rMhRdly.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\IaLStlb.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\EoAkaiy.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\sBlYTlz.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\NBSeUHY.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ICASIaE.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\dzzmuIE.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\HSDbHwP.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\DABfNVZ.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ISPmqxt.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\FaakZVE.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\MwwEIXt.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\UzBATdV.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\RVeIHHu.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\lLEZFOp.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\crhRock.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\WwGkaXU.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\ImlWvdw.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\feyyXEt.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\qdRrtBH.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\qqOlJNU.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\mHFOMmU.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\gZEFogx.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\gPpidKY.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\jXZgmdu.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\FtzprZr.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\Ttuozgh.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\fTYvAzq.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\PnGOxfv.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\mawXKqZ.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\nhyAbHO.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\pyBxOEV.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\qhbRkCf.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\tfgKMdU.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\dfZLLbN.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
File created	C:\Windows\System\lcORrBX.exe	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
Token: SeDebugPrivilege	2816	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2816	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2816	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2816	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2820	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2820	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2820	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	30
PID 2372 wrote to memory of 3068	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	31
PID 2372 wrote to memory of 3068	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	31
PID 2372 wrote to memory of 3068	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2204	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2204	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2204	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2116	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2116	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2116	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2604	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2604	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2604	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2672	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2672	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2672	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2700	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2700	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2700	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2588	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2588	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2588	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	37
PID 2372 wrote to memory of 3024	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	38
PID 2372 wrote to memory of 3024	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	38
PID 2372 wrote to memory of 3024	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2500	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2500	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2500	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2712	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2712	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2712	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2760	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2760	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2760	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2732	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2732	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2732	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2692	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	43
PID 2372 wrote to memory of 2692	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	43
PID 2372 wrote to memory of 2692	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	43
PID 2372 wrote to memory of 2484	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2484	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2484	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2540	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2540	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2540	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2928	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2928	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2928	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2972	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2972	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2972	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	47
PID 2372 wrote to memory of 952	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	48
PID 2372 wrote to memory of 952	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	48
PID 2372 wrote to memory of 952	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	48
PID 2372 wrote to memory of 2452	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2452	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2452	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2440	2372	0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b171985920af2fda9671dc9fa001f0b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\System\gChupWw.exe
  C:\Windows\System\gChupWw.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\WdCwjyY.exe
  C:\Windows\System\WdCwjyY.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\uNCAoIW.exe
  C:\Windows\System\uNCAoIW.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\gPpidKY.exe
  C:\Windows\System\gPpidKY.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\qqOlJNU.exe
  C:\Windows\System\qqOlJNU.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\SGeRYDi.exe
  C:\Windows\System\SGeRYDi.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\HkEiwaL.exe
  C:\Windows\System\HkEiwaL.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\qlsmsNg.exe
  C:\Windows\System\qlsmsNg.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\gnPFqFB.exe
  C:\Windows\System\gnPFqFB.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\WGwvzrr.exe
  C:\Windows\System\WGwvzrr.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\zCwVJgW.exe
  C:\Windows\System\zCwVJgW.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\EzWoGLg.exe
  C:\Windows\System\EzWoGLg.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\DWpguRG.exe
  C:\Windows\System\DWpguRG.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\wwkKmwv.exe
  C:\Windows\System\wwkKmwv.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\mHNyGjL.exe
  C:\Windows\System\mHNyGjL.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\etieeVb.exe
  C:\Windows\System\etieeVb.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\docrvta.exe
  C:\Windows\System\docrvta.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ISPmqxt.exe
  C:\Windows\System\ISPmqxt.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\tdGVYLO.exe
  C:\Windows\System\tdGVYLO.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\vhWCbxH.exe
  C:\Windows\System\vhWCbxH.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\qTWhCNZ.exe
  C:\Windows\System\qTWhCNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\KzqKtGF.exe
  C:\Windows\System\KzqKtGF.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ixygULo.exe
  C:\Windows\System\ixygULo.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\KEnxZYg.exe
  C:\Windows\System\KEnxZYg.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\MgBePWb.exe
  C:\Windows\System\MgBePWb.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\aVqzUub.exe
  C:\Windows\System\aVqzUub.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\jRmXROv.exe
  C:\Windows\System\jRmXROv.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\Xzgtugw.exe
  C:\Windows\System\Xzgtugw.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\Coacxjy.exe
  C:\Windows\System\Coacxjy.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\eTATNfz.exe
  C:\Windows\System\eTATNfz.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\znGeDpR.exe
  C:\Windows\System\znGeDpR.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\YKGensZ.exe
  C:\Windows\System\YKGensZ.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\AgtJsVU.exe
  C:\Windows\System\AgtJsVU.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\VjQsrMe.exe
  C:\Windows\System\VjQsrMe.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\ChZbVRU.exe
  C:\Windows\System\ChZbVRU.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\vPgKLCW.exe
  C:\Windows\System\vPgKLCW.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\olTfwdC.exe
  C:\Windows\System\olTfwdC.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\vlXHEIH.exe
  C:\Windows\System\vlXHEIH.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\aHfRsTQ.exe
  C:\Windows\System\aHfRsTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\OecdFHB.exe
  C:\Windows\System\OecdFHB.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OYsPXzc.exe
  C:\Windows\System\OYsPXzc.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\eYqDcau.exe
  C:\Windows\System\eYqDcau.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\fJIqjtG.exe
  C:\Windows\System\fJIqjtG.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\lBCJVuW.exe
  C:\Windows\System\lBCJVuW.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ssEqBPZ.exe
  C:\Windows\System\ssEqBPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\gnwkHOH.exe
  C:\Windows\System\gnwkHOH.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\SihtSht.exe
  C:\Windows\System\SihtSht.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\rFXcptj.exe
  C:\Windows\System\rFXcptj.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\dNRPMnu.exe
  C:\Windows\System\dNRPMnu.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\wHlGluT.exe
  C:\Windows\System\wHlGluT.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\MOjxlgk.exe
  C:\Windows\System\MOjxlgk.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\skaxIdP.exe
  C:\Windows\System\skaxIdP.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\diKFMiO.exe
  C:\Windows\System\diKFMiO.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nFfNXaG.exe
  C:\Windows\System\nFfNXaG.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\exSTvJI.exe
  C:\Windows\System\exSTvJI.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\LUjpeGk.exe
  C:\Windows\System\LUjpeGk.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\ZlofsLJ.exe
  C:\Windows\System\ZlofsLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\CxSFwVd.exe
  C:\Windows\System\CxSFwVd.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\YgkJxPV.exe
  C:\Windows\System\YgkJxPV.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\MIfsteq.exe
  C:\Windows\System\MIfsteq.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\thlyqYA.exe
  C:\Windows\System\thlyqYA.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\KvFCouw.exe
  C:\Windows\System\KvFCouw.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\HwvwVtb.exe
  C:\Windows\System\HwvwVtb.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\eLuKdwM.exe
  C:\Windows\System\eLuKdwM.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\GRkIMOU.exe
  C:\Windows\System\GRkIMOU.exe
  2⤵
  PID:2444
- C:\Windows\System\ngzCtuz.exe
  C:\Windows\System\ngzCtuz.exe
  2⤵
  PID:2544
- C:\Windows\System\uBuvMxG.exe
  C:\Windows\System\uBuvMxG.exe
  2⤵
  PID:1632
- C:\Windows\System\xxRrRpF.exe
  C:\Windows\System\xxRrRpF.exe
  2⤵
  PID:2648
- C:\Windows\System\hJLPprY.exe
  C:\Windows\System\hJLPprY.exe
  2⤵
  PID:1684
- C:\Windows\System\RCRZMhI.exe
  C:\Windows\System\RCRZMhI.exe
  2⤵
  PID:3064
- C:\Windows\System\efiTBVU.exe
  C:\Windows\System\efiTBVU.exe
  2⤵
  PID:968
- C:\Windows\System\zsKvcOb.exe
  C:\Windows\System\zsKvcOb.exe
  2⤵
  PID:2432
- C:\Windows\System\EUjPuIR.exe
  C:\Windows\System\EUjPuIR.exe
  2⤵
  PID:1992
- C:\Windows\System\TIWHKBq.exe
  C:\Windows\System\TIWHKBq.exe
  2⤵
  PID:1612
- C:\Windows\System\Kusvvpp.exe
  C:\Windows\System\Kusvvpp.exe
  2⤵
  PID:2388
- C:\Windows\System\LRnzfid.exe
  C:\Windows\System\LRnzfid.exe
  2⤵
  PID:3052
- C:\Windows\System\mocMHbE.exe
  C:\Windows\System\mocMHbE.exe
  2⤵
  PID:1732
- C:\Windows\System\GZcpKfc.exe
  C:\Windows\System\GZcpKfc.exe
  2⤵
  PID:2696
- C:\Windows\System\GRaAVfW.exe
  C:\Windows\System\GRaAVfW.exe
  2⤵
  PID:2480
- C:\Windows\System\FaakZVE.exe
  C:\Windows\System\FaakZVE.exe
  2⤵
  PID:3060
- C:\Windows\System\VimXAJQ.exe
  C:\Windows\System\VimXAJQ.exe
  2⤵
  PID:2472
- C:\Windows\System\OhSWcFx.exe
  C:\Windows\System\OhSWcFx.exe
  2⤵
  PID:2684
- C:\Windows\System\czWhraQ.exe
  C:\Windows\System\czWhraQ.exe
  2⤵
  PID:2624
- C:\Windows\System\BITTLdJ.exe
  C:\Windows\System\BITTLdJ.exe
  2⤵
  PID:2520
- C:\Windows\System\WUPMxHI.exe
  C:\Windows\System\WUPMxHI.exe
  2⤵
  PID:2528
- C:\Windows\System\ICwMKvB.exe
  C:\Windows\System\ICwMKvB.exe
  2⤵
  PID:1148
- C:\Windows\System\ZrNQUif.exe
  C:\Windows\System\ZrNQUif.exe
  2⤵
  PID:1124
- C:\Windows\System\ALXpdSY.exe
  C:\Windows\System\ALXpdSY.exe
  2⤵
  PID:648
- C:\Windows\System\YCVrtBy.exe
  C:\Windows\System\YCVrtBy.exe
  2⤵
  PID:1568
- C:\Windows\System\enafFmQ.exe
  C:\Windows\System\enafFmQ.exe
  2⤵
  PID:1764
- C:\Windows\System\hSgNkho.exe
  C:\Windows\System\hSgNkho.exe
  2⤵
  PID:2448
- C:\Windows\System\jldGVcZ.exe
  C:\Windows\System\jldGVcZ.exe
  2⤵
  PID:2592
- C:\Windows\System\SZvzVVE.exe
  C:\Windows\System\SZvzVVE.exe
  2⤵
  PID:868
- C:\Windows\System\wIHRDWI.exe
  C:\Windows\System\wIHRDWI.exe
  2⤵
  PID:1100
- C:\Windows\System\asHfoIW.exe
  C:\Windows\System\asHfoIW.exe
  2⤵
  PID:1092
- C:\Windows\System\rKqXeTh.exe
  C:\Windows\System\rKqXeTh.exe
  2⤵
  PID:2776
- C:\Windows\System\ljplhmp.exe
  C:\Windows\System\ljplhmp.exe
  2⤵
  PID:1500
- C:\Windows\System\ODrKfKg.exe
  C:\Windows\System\ODrKfKg.exe
  2⤵
  PID:1360
- C:\Windows\System\GqLxDEu.exe
  C:\Windows\System\GqLxDEu.exe
  2⤵
  PID:1892
- C:\Windows\System\xqhiAHt.exe
  C:\Windows\System\xqhiAHt.exe
  2⤵
  PID:1872
- C:\Windows\System\nmeagQf.exe
  C:\Windows\System\nmeagQf.exe
  2⤵
  PID:2180
- C:\Windows\System\ONyNdTe.exe
  C:\Windows\System\ONyNdTe.exe
  2⤵
  PID:1240
- C:\Windows\System\mrfOBcf.exe
  C:\Windows\System\mrfOBcf.exe
  2⤵
  PID:2288
- C:\Windows\System\LmjRvbT.exe
  C:\Windows\System\LmjRvbT.exe
  2⤵
  PID:708
- C:\Windows\System\BHTpOMo.exe
  C:\Windows\System\BHTpOMo.exe
  2⤵
  PID:2324
- C:\Windows\System\OYfhYdu.exe
  C:\Windows\System\OYfhYdu.exe
  2⤵
  PID:2576
- C:\Windows\System\hcIRkPa.exe
  C:\Windows\System\hcIRkPa.exe
  2⤵
  PID:2808
- C:\Windows\System\TZVQcIb.exe
  C:\Windows\System\TZVQcIb.exe
  2⤵
  PID:2580
- C:\Windows\System\kadlrvK.exe
  C:\Windows\System\kadlrvK.exe
  2⤵
  PID:3080
- C:\Windows\System\biybCIw.exe
  C:\Windows\System\biybCIw.exe
  2⤵
  PID:3096
- C:\Windows\System\OQnjTlK.exe
  C:\Windows\System\OQnjTlK.exe
  2⤵
  PID:3112
- C:\Windows\System\FGyUFxk.exe
  C:\Windows\System\FGyUFxk.exe
  2⤵
  PID:3128
- C:\Windows\System\tjYtGnp.exe
  C:\Windows\System\tjYtGnp.exe
  2⤵
  PID:3144
- C:\Windows\System\rbuSFAt.exe
  C:\Windows\System\rbuSFAt.exe
  2⤵
  PID:3160
- C:\Windows\System\AAUIRpx.exe
  C:\Windows\System\AAUIRpx.exe
  2⤵
  PID:3176
- C:\Windows\System\ygIgRCN.exe
  C:\Windows\System\ygIgRCN.exe
  2⤵
  PID:3192
- C:\Windows\System\JiCKDzG.exe
  C:\Windows\System\JiCKDzG.exe
  2⤵
  PID:3208
- C:\Windows\System\JTOhFNz.exe
  C:\Windows\System\JTOhFNz.exe
  2⤵
  PID:3224
- C:\Windows\System\bRjYunr.exe
  C:\Windows\System\bRjYunr.exe
  2⤵
  PID:3240
- C:\Windows\System\yMXYYlK.exe
  C:\Windows\System\yMXYYlK.exe
  2⤵
  PID:3256
- C:\Windows\System\wUYgOJz.exe
  C:\Windows\System\wUYgOJz.exe
  2⤵
  PID:3272
- C:\Windows\System\ZWGuYtm.exe
  C:\Windows\System\ZWGuYtm.exe
  2⤵
  PID:3288
- C:\Windows\System\FTXMDCH.exe
  C:\Windows\System\FTXMDCH.exe
  2⤵
  PID:3304
- C:\Windows\System\eoHSjlN.exe
  C:\Windows\System\eoHSjlN.exe
  2⤵
  PID:3320
- C:\Windows\System\qjsEYgR.exe
  C:\Windows\System\qjsEYgR.exe
  2⤵
  PID:3336
- C:\Windows\System\GSfoZQs.exe
  C:\Windows\System\GSfoZQs.exe
  2⤵
  PID:3352
- C:\Windows\System\iFRbYtd.exe
  C:\Windows\System\iFRbYtd.exe
  2⤵
  PID:3368
- C:\Windows\System\ElScsDo.exe
  C:\Windows\System\ElScsDo.exe
  2⤵
  PID:3384
- C:\Windows\System\bwcmGAj.exe
  C:\Windows\System\bwcmGAj.exe
  2⤵
  PID:3400
- C:\Windows\System\qJvzXNo.exe
  C:\Windows\System\qJvzXNo.exe
  2⤵
  PID:3416
- C:\Windows\System\HrBwhOj.exe
  C:\Windows\System\HrBwhOj.exe
  2⤵
  PID:3432
- C:\Windows\System\KcWJQiB.exe
  C:\Windows\System\KcWJQiB.exe
  2⤵
  PID:3448
- C:\Windows\System\QFynhCY.exe
  C:\Windows\System\QFynhCY.exe
  2⤵
  PID:3464
- C:\Windows\System\YSeSycB.exe
  C:\Windows\System\YSeSycB.exe
  2⤵
  PID:3480
- C:\Windows\System\MUZlkdD.exe
  C:\Windows\System\MUZlkdD.exe
  2⤵
  PID:3496
- C:\Windows\System\GJWPccQ.exe
  C:\Windows\System\GJWPccQ.exe
  2⤵
  PID:3512
- C:\Windows\System\lZlhsoF.exe
  C:\Windows\System\lZlhsoF.exe
  2⤵
  PID:3528
- C:\Windows\System\GYbxeoO.exe
  C:\Windows\System\GYbxeoO.exe
  2⤵
  PID:3544
- C:\Windows\System\MwwEIXt.exe
  C:\Windows\System\MwwEIXt.exe
  2⤵
  PID:3560
- C:\Windows\System\vfxumbi.exe
  C:\Windows\System\vfxumbi.exe
  2⤵
  PID:3576
- C:\Windows\System\LfjfvFs.exe
  C:\Windows\System\LfjfvFs.exe
  2⤵
  PID:3592
- C:\Windows\System\LegkHgV.exe
  C:\Windows\System\LegkHgV.exe
  2⤵
  PID:3608
- C:\Windows\System\GPUcLTA.exe
  C:\Windows\System\GPUcLTA.exe
  2⤵
  PID:3624
- C:\Windows\System\WtQuMMx.exe
  C:\Windows\System\WtQuMMx.exe
  2⤵
  PID:3640
- C:\Windows\System\OkuXbep.exe
  C:\Windows\System\OkuXbep.exe
  2⤵
  PID:3656
- C:\Windows\System\zpMeSki.exe
  C:\Windows\System\zpMeSki.exe
  2⤵
  PID:3672
- C:\Windows\System\hqRvxJr.exe
  C:\Windows\System\hqRvxJr.exe
  2⤵
  PID:3688
- C:\Windows\System\rzmJZYF.exe
  C:\Windows\System\rzmJZYF.exe
  2⤵
  PID:3704
- C:\Windows\System\JPTqwoY.exe
  C:\Windows\System\JPTqwoY.exe
  2⤵
  PID:3720
- C:\Windows\System\GZoeCys.exe
  C:\Windows\System\GZoeCys.exe
  2⤵
  PID:3736
- C:\Windows\System\wdsZSrl.exe
  C:\Windows\System\wdsZSrl.exe
  2⤵
  PID:3752
- C:\Windows\System\tXNQJnk.exe
  C:\Windows\System\tXNQJnk.exe
  2⤵
  PID:3768
- C:\Windows\System\ALLgaWh.exe
  C:\Windows\System\ALLgaWh.exe
  2⤵
  PID:3784
- C:\Windows\System\wvmxCtR.exe
  C:\Windows\System\wvmxCtR.exe
  2⤵
  PID:3800
- C:\Windows\System\mYqKjje.exe
  C:\Windows\System\mYqKjje.exe
  2⤵
  PID:3816
- C:\Windows\System\XicEDtI.exe
  C:\Windows\System\XicEDtI.exe
  2⤵
  PID:3832
- C:\Windows\System\dMIYBnA.exe
  C:\Windows\System\dMIYBnA.exe
  2⤵
  PID:3848
- C:\Windows\System\NFALvov.exe
  C:\Windows\System\NFALvov.exe
  2⤵
  PID:3864
- C:\Windows\System\pNglMIR.exe
  C:\Windows\System\pNglMIR.exe
  2⤵
  PID:3880
- C:\Windows\System\AvGykZe.exe
  C:\Windows\System\AvGykZe.exe
  2⤵
  PID:3896
- C:\Windows\System\yONRPIu.exe
  C:\Windows\System\yONRPIu.exe
  2⤵
  PID:3912
- C:\Windows\System\yZxtLsr.exe
  C:\Windows\System\yZxtLsr.exe
  2⤵
  PID:3928
- C:\Windows\System\lxDJRzS.exe
  C:\Windows\System\lxDJRzS.exe
  2⤵
  PID:3944
- C:\Windows\System\CPOhAUP.exe
  C:\Windows\System\CPOhAUP.exe
  2⤵
  PID:3960
- C:\Windows\System\oldIwCY.exe
  C:\Windows\System\oldIwCY.exe
  2⤵
  PID:3976
- C:\Windows\System\tYHIMrJ.exe
  C:\Windows\System\tYHIMrJ.exe
  2⤵
  PID:3992
- C:\Windows\System\DHogbvn.exe
  C:\Windows\System\DHogbvn.exe
  2⤵
  PID:4008
- C:\Windows\System\rMhRdly.exe
  C:\Windows\System\rMhRdly.exe
  2⤵
  PID:4024
- C:\Windows\System\vezXIXX.exe
  C:\Windows\System\vezXIXX.exe
  2⤵
  PID:4040
- C:\Windows\System\gjAdAPr.exe
  C:\Windows\System\gjAdAPr.exe
  2⤵
  PID:4056
- C:\Windows\System\SBnzKAr.exe
  C:\Windows\System\SBnzKAr.exe
  2⤵
  PID:4072
- C:\Windows\System\pZOPaYY.exe
  C:\Windows\System\pZOPaYY.exe
  2⤵
  PID:4088
- C:\Windows\System\SypPiWg.exe
  C:\Windows\System\SypPiWg.exe
  2⤵
  PID:3088
- C:\Windows\System\XFaviIA.exe
  C:\Windows\System\XFaviIA.exe
  2⤵
  PID:3120
- C:\Windows\System\GCqEqyi.exe
  C:\Windows\System\GCqEqyi.exe
  2⤵
  PID:2268
- C:\Windows\System\hrkisEP.exe
  C:\Windows\System\hrkisEP.exe
  2⤵
  PID:2680
- C:\Windows\System\mJsceJr.exe
  C:\Windows\System\mJsceJr.exe
  2⤵
  PID:2756
- C:\Windows\System\xQBJVlI.exe
  C:\Windows\System\xQBJVlI.exe
  2⤵
  PID:4104
- C:\Windows\System\esshSaf.exe
  C:\Windows\System\esshSaf.exe
  2⤵
  PID:4120
- C:\Windows\System\lysgYaj.exe
  C:\Windows\System\lysgYaj.exe
  2⤵
  PID:4136
- C:\Windows\System\bMWBKZr.exe
  C:\Windows\System\bMWBKZr.exe
  2⤵
  PID:4152
- C:\Windows\System\baueCwn.exe
  C:\Windows\System\baueCwn.exe
  2⤵
  PID:4168
- C:\Windows\System\IMkNTKV.exe
  C:\Windows\System\IMkNTKV.exe
  2⤵
  PID:4184
- C:\Windows\System\YRPFCHG.exe
  C:\Windows\System\YRPFCHG.exe
  2⤵
  PID:4200
- C:\Windows\System\iLQZmkF.exe
  C:\Windows\System\iLQZmkF.exe
  2⤵
  PID:4216
- C:\Windows\System\yNZdlIE.exe
  C:\Windows\System\yNZdlIE.exe
  2⤵
  PID:4236
- C:\Windows\System\YgkOCUh.exe
  C:\Windows\System\YgkOCUh.exe
  2⤵
  PID:4252
- C:\Windows\System\cYEYMRo.exe
  C:\Windows\System\cYEYMRo.exe
  2⤵
  PID:4268
- C:\Windows\System\qSKgTXP.exe
  C:\Windows\System\qSKgTXP.exe
  2⤵
  PID:4284
- C:\Windows\System\KMjrsMv.exe
  C:\Windows\System\KMjrsMv.exe
  2⤵
  PID:4300
- C:\Windows\System\OCvDsmz.exe
  C:\Windows\System\OCvDsmz.exe
  2⤵
  PID:4316
- C:\Windows\System\MOtcuBC.exe
  C:\Windows\System\MOtcuBC.exe
  2⤵
  PID:4556
- C:\Windows\System\suRdNnx.exe
  C:\Windows\System\suRdNnx.exe
  2⤵
  PID:4572
- C:\Windows\System\zEDOFtl.exe
  C:\Windows\System\zEDOFtl.exe
  2⤵
  PID:4588
- C:\Windows\System\TOTwZbJ.exe
  C:\Windows\System\TOTwZbJ.exe
  2⤵
  PID:4604
- C:\Windows\System\ThJzFpx.exe
  C:\Windows\System\ThJzFpx.exe
  2⤵
  PID:4620
- C:\Windows\System\EjVutIn.exe
  C:\Windows\System\EjVutIn.exe
  2⤵
  PID:4636
- C:\Windows\System\wdbryxe.exe
  C:\Windows\System\wdbryxe.exe
  2⤵
  PID:4652
- C:\Windows\System\zqtTejC.exe
  C:\Windows\System\zqtTejC.exe
  2⤵
  PID:4668
- C:\Windows\System\DQmGoMl.exe
  C:\Windows\System\DQmGoMl.exe
  2⤵
  PID:4684
- C:\Windows\System\VaggkWI.exe
  C:\Windows\System\VaggkWI.exe
  2⤵
  PID:4700
- C:\Windows\System\EVjzqGk.exe
  C:\Windows\System\EVjzqGk.exe
  2⤵
  PID:4716
- C:\Windows\System\LXGzqUD.exe
  C:\Windows\System\LXGzqUD.exe
  2⤵
  PID:4732
- C:\Windows\System\XEwhTSR.exe
  C:\Windows\System\XEwhTSR.exe
  2⤵
  PID:4748
- C:\Windows\System\KcYtvCQ.exe
  C:\Windows\System\KcYtvCQ.exe
  2⤵
  PID:4764
- C:\Windows\System\JfOQjPt.exe
  C:\Windows\System\JfOQjPt.exe
  2⤵
  PID:4780
- C:\Windows\System\WhcMHuC.exe
  C:\Windows\System\WhcMHuC.exe
  2⤵
  PID:4796
- C:\Windows\System\NBSeUHY.exe
  C:\Windows\System\NBSeUHY.exe
  2⤵
  PID:4812
- C:\Windows\System\SheUghE.exe
  C:\Windows\System\SheUghE.exe
  2⤵
  PID:4828
- C:\Windows\System\hfJXIYf.exe
  C:\Windows\System\hfJXIYf.exe
  2⤵
  PID:4844
- C:\Windows\System\xzXDEgI.exe
  C:\Windows\System\xzXDEgI.exe
  2⤵
  PID:4860
- C:\Windows\System\SiOPSok.exe
  C:\Windows\System\SiOPSok.exe
  2⤵
  PID:4880
- C:\Windows\System\KUnmDVK.exe
  C:\Windows\System\KUnmDVK.exe
  2⤵
  PID:4964
- C:\Windows\System\BbhWIvy.exe
  C:\Windows\System\BbhWIvy.exe
  2⤵
  PID:4980
- C:\Windows\System\DDobiFX.exe
  C:\Windows\System\DDobiFX.exe
  2⤵
  PID:4996
- C:\Windows\System\jpONCbG.exe
  C:\Windows\System\jpONCbG.exe
  2⤵
  PID:5012
- C:\Windows\System\VjiGlYm.exe
  C:\Windows\System\VjiGlYm.exe
  2⤵
  PID:5028
- C:\Windows\System\UoBKOoM.exe
  C:\Windows\System\UoBKOoM.exe
  2⤵
  PID:5044
- C:\Windows\System\ccwlyRs.exe
  C:\Windows\System\ccwlyRs.exe
  2⤵
  PID:5060
- C:\Windows\System\TMfvKIy.exe
  C:\Windows\System\TMfvKIy.exe
  2⤵
  PID:5076
- C:\Windows\System\dAHkOIw.exe
  C:\Windows\System\dAHkOIw.exe
  2⤵
  PID:5092
- C:\Windows\System\nNfGxXK.exe
  C:\Windows\System\nNfGxXK.exe
  2⤵
  PID:5108
- C:\Windows\System\gxDjZWx.exe
  C:\Windows\System\gxDjZWx.exe
  2⤵
  PID:2200
- C:\Windows\System\cGZDvjM.exe
  C:\Windows\System\cGZDvjM.exe
  2⤵
  PID:448
- C:\Windows\System\MUXHMVd.exe
  C:\Windows\System\MUXHMVd.exe
  2⤵
  PID:2232
- C:\Windows\System\IJOMflX.exe
  C:\Windows\System\IJOMflX.exe
  2⤵
  PID:1628
- C:\Windows\System\qhbRkCf.exe
  C:\Windows\System\qhbRkCf.exe
  2⤵
  PID:1176
- C:\Windows\System\PRhOKAQ.exe
  C:\Windows\System\PRhOKAQ.exe
  2⤵
  PID:3424
- C:\Windows\System\Hmssosf.exe
  C:\Windows\System\Hmssosf.exe
  2⤵
  PID:3648
- C:\Windows\System\QoBXVRn.exe
  C:\Windows\System\QoBXVRn.exe
  2⤵
  PID:3748
- C:\Windows\System\sCLjoAZ.exe
  C:\Windows\System\sCLjoAZ.exe
  2⤵
  PID:3812
- C:\Windows\System\tYSKsAO.exe
  C:\Windows\System\tYSKsAO.exe
  2⤵
  PID:3936
- C:\Windows\System\upkbnYy.exe
  C:\Windows\System\upkbnYy.exe
  2⤵
  PID:4004
- C:\Windows\System\duwXkhN.exe
  C:\Windows\System\duwXkhN.exe
  2⤵
  PID:3252
- C:\Windows\System\VTxIYVR.exe
  C:\Windows\System\VTxIYVR.exe
  2⤵
  PID:3316
- C:\Windows\System\HIEbehr.exe
  C:\Windows\System\HIEbehr.exe
  2⤵
  PID:2800
- C:\Windows\System\mUdIQVT.exe
  C:\Windows\System\mUdIQVT.exe
  2⤵
  PID:4148
- C:\Windows\System\qLCrBND.exe
  C:\Windows\System\qLCrBND.exe
  2⤵
  PID:3380
- C:\Windows\System\CIeDzCN.exe
  C:\Windows\System\CIeDzCN.exe
  2⤵
  PID:3444
- C:\Windows\System\zbGscum.exe
  C:\Windows\System\zbGscum.exe
  2⤵
  PID:3508
- C:\Windows\System\aGVrRNg.exe
  C:\Windows\System\aGVrRNg.exe
  2⤵
  PID:3572
- C:\Windows\System\grMWRTg.exe
  C:\Windows\System\grMWRTg.exe
  2⤵
  PID:3636
- C:\Windows\System\OGERqXe.exe
  C:\Windows\System\OGERqXe.exe
  2⤵
  PID:3700
- C:\Windows\System\jFsNaCM.exe
  C:\Windows\System\jFsNaCM.exe
  2⤵
  PID:3764
- C:\Windows\System\OjhLpNh.exe
  C:\Windows\System\OjhLpNh.exe
  2⤵
  PID:3828
- C:\Windows\System\SALoIOD.exe
  C:\Windows\System\SALoIOD.exe
  2⤵
  PID:3892
- C:\Windows\System\xAjXavC.exe
  C:\Windows\System\xAjXavC.exe
  2⤵
  PID:3956
- C:\Windows\System\bYuOAeu.exe
  C:\Windows\System\bYuOAeu.exe
  2⤵
  PID:4020
- C:\Windows\System\hVpfLNe.exe
  C:\Windows\System\hVpfLNe.exe
  2⤵
  PID:4084
- C:\Windows\System\NRYQCyn.exe
  C:\Windows\System\NRYQCyn.exe
  2⤵
  PID:4100
- C:\Windows\System\VbNvlqQ.exe
  C:\Windows\System\VbNvlqQ.exe
  2⤵
  PID:4192
- C:\Windows\System\OXOXKLa.exe
  C:\Windows\System\OXOXKLa.exe
  2⤵
  PID:4232
- C:\Windows\System\knroVej.exe
  C:\Windows\System\knroVej.exe
  2⤵
  PID:4332
- C:\Windows\System\VnUCRKB.exe
  C:\Windows\System\VnUCRKB.exe
  2⤵
  PID:4384
- C:\Windows\System\JfGALAz.exe
  C:\Windows\System\JfGALAz.exe
  2⤵
  PID:4400
- C:\Windows\System\zXIHViM.exe
  C:\Windows\System\zXIHViM.exe
  2⤵
  PID:4416
- C:\Windows\System\isjNPou.exe
  C:\Windows\System\isjNPou.exe
  2⤵
  PID:4432
- C:\Windows\System\yoVArsA.exe
  C:\Windows\System\yoVArsA.exe
  2⤵
  PID:4448
- C:\Windows\System\dbALqYk.exe
  C:\Windows\System\dbALqYk.exe
  2⤵
  PID:4464
- C:\Windows\System\tfgKMdU.exe
  C:\Windows\System\tfgKMdU.exe
  2⤵
  PID:4480
- C:\Windows\System\OjObRSK.exe
  C:\Windows\System\OjObRSK.exe
  2⤵
  PID:4496
- C:\Windows\System\DMWxkUl.exe
  C:\Windows\System\DMWxkUl.exe
  2⤵
  PID:4512
- C:\Windows\System\PnGOxfv.exe
  C:\Windows\System\PnGOxfv.exe
  2⤵
  PID:4176
- C:\Windows\System\iAZbAhQ.exe
  C:\Windows\System\iAZbAhQ.exe
  2⤵
  PID:4280
- C:\Windows\System\iqfTvWl.exe
  C:\Windows\System\iqfTvWl.exe
  2⤵
  PID:1832
- C:\Windows\System\UsWqucO.exe
  C:\Windows\System\UsWqucO.exe
  2⤵
  PID:1924
- C:\Windows\System\dMDugoN.exe
  C:\Windows\System\dMDugoN.exe
  2⤵
  PID:1048
- C:\Windows\System\UZNdqWM.exe
  C:\Windows\System\UZNdqWM.exe
  2⤵
  PID:3300
- C:\Windows\System\TjlFYDi.exe
  C:\Windows\System\TjlFYDi.exe
  2⤵
  PID:4532
- C:\Windows\System\PnxUdno.exe
  C:\Windows\System\PnxUdno.exe
  2⤵
  PID:4584
- C:\Windows\System\WaItSie.exe
  C:\Windows\System\WaItSie.exe
  2⤵
  PID:4680
- C:\Windows\System\GTXMQqk.exe
  C:\Windows\System\GTXMQqk.exe
  2⤵
  PID:4744
- C:\Windows\System\LOwiUxv.exe
  C:\Windows\System\LOwiUxv.exe
  2⤵
  PID:4808
- C:\Windows\System\SDqUCGy.exe
  C:\Windows\System\SDqUCGy.exe
  2⤵
  PID:3844
- C:\Windows\System\mawXKqZ.exe
  C:\Windows\System\mawXKqZ.exe
  2⤵
  PID:4064
- C:\Windows\System\oUeaUhP.exe
  C:\Windows\System\oUeaUhP.exe
  2⤵
  PID:4840
- C:\Windows\System\BGVBPOs.exe
  C:\Windows\System\BGVBPOs.exe
  2⤵
  PID:4208
- C:\Windows\System\zNnqHhL.exe
  C:\Windows\System\zNnqHhL.exe
  2⤵
  PID:4788
- C:\Windows\System\ukqlUdv.exe
  C:\Windows\System\ukqlUdv.exe
  2⤵
  PID:4852
- C:\Windows\System\EpjEKjt.exe
  C:\Windows\System\EpjEKjt.exe
  2⤵
  PID:4564
- C:\Windows\System\GbqFZED.exe
  C:\Windows\System\GbqFZED.exe
  2⤵
  PID:4628
- C:\Windows\System\yEjaTHs.exe
  C:\Windows\System\yEjaTHs.exe
  2⤵
  PID:4692
- C:\Windows\System\QRYndyA.exe
  C:\Windows\System\QRYndyA.exe
  2⤵
  PID:4756
- C:\Windows\System\PRsKsNg.exe
  C:\Windows\System\PRsKsNg.exe
  2⤵
  PID:860
- C:\Windows\System\AiWDuxS.exe
  C:\Windows\System\AiWDuxS.exe
  2⤵
  PID:1840
- C:\Windows\System\NtqalrL.exe
  C:\Windows\System\NtqalrL.exe
  2⤵
  PID:1824
- C:\Windows\System\IaLStlb.exe
  C:\Windows\System\IaLStlb.exe
  2⤵
  PID:2172
- C:\Windows\System\SeyTZUP.exe
  C:\Windows\System\SeyTZUP.exe
  2⤵
  PID:4916
- C:\Windows\System\BWqInSQ.exe
  C:\Windows\System\BWqInSQ.exe
  2⤵
  PID:4932
- C:\Windows\System\AGqdHNU.exe
  C:\Windows\System\AGqdHNU.exe
  2⤵
  PID:4948
- C:\Windows\System\djSOLIB.exe
  C:\Windows\System\djSOLIB.exe
  2⤵
  PID:4988
- C:\Windows\System\VyiHilU.exe
  C:\Windows\System\VyiHilU.exe
  2⤵
  PID:5052
- C:\Windows\System\AAVfEOL.exe
  C:\Windows\System\AAVfEOL.exe
  2⤵
  PID:1996
- C:\Windows\System\oyATEZs.exe
  C:\Windows\System\oyATEZs.exe
  2⤵
  PID:2468
- C:\Windows\System\mBnaSie.exe
  C:\Windows\System\mBnaSie.exe
  2⤵
  PID:4976
- C:\Windows\System\xlaDiuL.exe
  C:\Windows\System\xlaDiuL.exe
  2⤵
  PID:5040
- C:\Windows\System\RjyiYmj.exe
  C:\Windows\System\RjyiYmj.exe
  2⤵
  PID:5104
- C:\Windows\System\IoGEAyc.exe
  C:\Windows\System\IoGEAyc.exe
  2⤵
  PID:2596
- C:\Windows\System\xzeoOBQ.exe
  C:\Windows\System\xzeoOBQ.exe
  2⤵
  PID:1532
- C:\Windows\System\JnrkdwF.exe
  C:\Windows\System\JnrkdwF.exe
  2⤵
  PID:2368
- C:\Windows\System\RnvPzQz.exe
  C:\Windows\System\RnvPzQz.exe
  2⤵
  PID:3076
- C:\Windows\System\qRIESoq.exe
  C:\Windows\System\qRIESoq.exe
  2⤵
  PID:3492
- C:\Windows\System\TxXuuLe.exe
  C:\Windows\System\TxXuuLe.exe
  2⤵
  PID:3584
- C:\Windows\System\bkmgYJv.exe
  C:\Windows\System\bkmgYJv.exe
  2⤵
  PID:3332
- C:\Windows\System\bvvXpGF.exe
  C:\Windows\System\bvvXpGF.exe
  2⤵
  PID:2652
- C:\Windows\System\OfatRzC.exe
  C:\Windows\System\OfatRzC.exe
  2⤵
  PID:3620
- C:\Windows\System\ARuYjDu.exe
  C:\Windows\System\ARuYjDu.exe
  2⤵
  PID:3908
- C:\Windows\System\FzpOuNY.exe
  C:\Windows\System\FzpOuNY.exe
  2⤵
  PID:3972
- C:\Windows\System\QoDvcyk.exe
  C:\Windows\System\QoDvcyk.exe
  2⤵
  PID:3348
- C:\Windows\System\USCqhpa.exe
  C:\Windows\System\USCqhpa.exe
  2⤵
  PID:3476
- C:\Windows\System\CfPxHqS.exe
  C:\Windows\System\CfPxHqS.exe
  2⤵
  PID:4116
- C:\Windows\System\lsUBfsn.exe
  C:\Windows\System\lsUBfsn.exe
  2⤵
  PID:3732
- C:\Windows\System\kfwibUL.exe
  C:\Windows\System\kfwibUL.exe
  2⤵
  PID:3888
- C:\Windows\System\eXNwHdH.exe
  C:\Windows\System\eXNwHdH.exe
  2⤵
  PID:3184
- C:\Windows\System\NPBekDF.exe
  C:\Windows\System\NPBekDF.exe
  2⤵
  PID:4348
- C:\Windows\System\sJJHLKz.exe
  C:\Windows\System\sJJHLKz.exe
  2⤵
  PID:4360
- C:\Windows\System\AGDioZz.exe
  C:\Windows\System\AGDioZz.exe
  2⤵
  PID:4380
- C:\Windows\System\BBtCVeW.exe
  C:\Windows\System\BBtCVeW.exe
  2⤵
  PID:4440
- C:\Windows\System\RPClANP.exe
  C:\Windows\System\RPClANP.exe
  2⤵
  PID:4504
- C:\Windows\System\crhRock.exe
  C:\Windows\System\crhRock.exe
  2⤵
  PID:2176
- C:\Windows\System\fqnhTHD.exe
  C:\Windows\System\fqnhTHD.exe
  2⤵
  PID:4536
- C:\Windows\System\LqjkGyI.exe
  C:\Windows\System\LqjkGyI.exe
  2⤵
  PID:3588
- C:\Windows\System\RuhYnAw.exe
  C:\Windows\System\RuhYnAw.exe
  2⤵
  PID:3716
- C:\Windows\System\qLtBBDt.exe
  C:\Windows\System\qLtBBDt.exe
  2⤵
  PID:600
- C:\Windows\System\CozLmTi.exe
  C:\Windows\System\CozLmTi.exe
  2⤵
  PID:1820
- C:\Windows\System\zvxfNkL.exe
  C:\Windows\System\zvxfNkL.exe
  2⤵
  PID:1744
- C:\Windows\System\uYJqLkw.exe
  C:\Windows\System\uYJqLkw.exe
  2⤵
  PID:4908
- C:\Windows\System\HqjaJkr.exe
  C:\Windows\System\HqjaJkr.exe
  2⤵
  PID:5020
- C:\Windows\System\LaozrXC.exe
  C:\Windows\System\LaozrXC.exe
  2⤵
  PID:1812
- C:\Windows\System\RAIFGpy.exe
  C:\Windows\System\RAIFGpy.exe
  2⤵
  PID:1620
- C:\Windows\System\RXUiaJJ.exe
  C:\Windows\System\RXUiaJJ.exe
  2⤵
  PID:3684
- C:\Windows\System\Imiefoi.exe
  C:\Windows\System\Imiefoi.exe
  2⤵
  PID:3616
- C:\Windows\System\HTFLUoY.exe
  C:\Windows\System\HTFLUoY.exe
  2⤵
  PID:3312
- C:\Windows\System\VHVCZBi.exe
  C:\Windows\System\VHVCZBi.exe
  2⤵
  PID:4228
- C:\Windows\System\fvaqaMi.exe
  C:\Windows\System\fvaqaMi.exe
  2⤵
  PID:4404
- C:\Windows\System\dfbWbMh.exe
  C:\Windows\System\dfbWbMh.exe
  2⤵
  PID:4328
- C:\Windows\System\nzachjx.exe
  C:\Windows\System\nzachjx.exe
  2⤵
  PID:4900
- C:\Windows\System\Noxbdxy.exe
  C:\Windows\System\Noxbdxy.exe
  2⤵
  PID:2508
- C:\Windows\System\FOAkxAE.exe
  C:\Windows\System\FOAkxAE.exe
  2⤵
  PID:5128
- C:\Windows\System\jyAOZBg.exe
  C:\Windows\System\jyAOZBg.exe
  2⤵
  PID:5144
- C:\Windows\System\ZtzjSKU.exe
  C:\Windows\System\ZtzjSKU.exe
  2⤵
  PID:5160
- C:\Windows\System\CWKKlpn.exe
  C:\Windows\System\CWKKlpn.exe
  2⤵
  PID:5176
- C:\Windows\System\VUkgsXL.exe
  C:\Windows\System\VUkgsXL.exe
  2⤵
  PID:5192
- C:\Windows\System\iKvTDjN.exe
  C:\Windows\System\iKvTDjN.exe
  2⤵
  PID:5208
- C:\Windows\System\TvDIUtS.exe
  C:\Windows\System\TvDIUtS.exe
  2⤵
  PID:5224
- C:\Windows\System\GkAAJxN.exe
  C:\Windows\System\GkAAJxN.exe
  2⤵
  PID:5240
- C:\Windows\System\fUzXEMJ.exe
  C:\Windows\System\fUzXEMJ.exe
  2⤵
  PID:5256
- C:\Windows\System\sdaCUXF.exe
  C:\Windows\System\sdaCUXF.exe
  2⤵
  PID:5272
- C:\Windows\System\RyYAvCB.exe
  C:\Windows\System\RyYAvCB.exe
  2⤵
  PID:5288
- C:\Windows\System\jtWHIRU.exe
  C:\Windows\System\jtWHIRU.exe
  2⤵
  PID:5304
- C:\Windows\System\nmsRbSI.exe
  C:\Windows\System\nmsRbSI.exe
  2⤵
  PID:5320
- C:\Windows\System\Blnugtk.exe
  C:\Windows\System\Blnugtk.exe
  2⤵
  PID:5336
- C:\Windows\System\HsSHEqC.exe
  C:\Windows\System\HsSHEqC.exe
  2⤵
  PID:5352
- C:\Windows\System\bFptDmO.exe
  C:\Windows\System\bFptDmO.exe
  2⤵
  PID:5368
- C:\Windows\System\mbwzWCL.exe
  C:\Windows\System\mbwzWCL.exe
  2⤵
  PID:5384
- C:\Windows\System\ijTxxIs.exe
  C:\Windows\System\ijTxxIs.exe
  2⤵
  PID:5400
- C:\Windows\System\cMJIRPY.exe
  C:\Windows\System\cMJIRPY.exe
  2⤵
  PID:5416
- C:\Windows\System\oJVUCCw.exe
  C:\Windows\System\oJVUCCw.exe
  2⤵
  PID:5432
- C:\Windows\System\jwMynWu.exe
  C:\Windows\System\jwMynWu.exe
  2⤵
  PID:5448
- C:\Windows\System\kfOSZcx.exe
  C:\Windows\System\kfOSZcx.exe
  2⤵
  PID:5464
- C:\Windows\System\sYhnIuj.exe
  C:\Windows\System\sYhnIuj.exe
  2⤵
  PID:5480
- C:\Windows\System\oTQEEvA.exe
  C:\Windows\System\oTQEEvA.exe
  2⤵
  PID:5496
- C:\Windows\System\gIeukiY.exe
  C:\Windows\System\gIeukiY.exe
  2⤵
  PID:5512
- C:\Windows\System\gBbpNpX.exe
  C:\Windows\System\gBbpNpX.exe
  2⤵
  PID:5528
- C:\Windows\System\dsINRfh.exe
  C:\Windows\System\dsINRfh.exe
  2⤵
  PID:5544
- C:\Windows\System\qPyZddU.exe
  C:\Windows\System\qPyZddU.exe
  2⤵
  PID:5560
- C:\Windows\System\HVFSgxQ.exe
  C:\Windows\System\HVFSgxQ.exe
  2⤵
  PID:5576
- C:\Windows\System\xSuavHE.exe
  C:\Windows\System\xSuavHE.exe
  2⤵
  PID:5592
- C:\Windows\System\ArqkUpl.exe
  C:\Windows\System\ArqkUpl.exe
  2⤵
  PID:5608
- C:\Windows\System\uabwCYM.exe
  C:\Windows\System\uabwCYM.exe
  2⤵
  PID:5624
- C:\Windows\System\JqMhYvT.exe
  C:\Windows\System\JqMhYvT.exe
  2⤵
  PID:5640
- C:\Windows\System\YkAYTtf.exe
  C:\Windows\System\YkAYTtf.exe
  2⤵
  PID:5820
- C:\Windows\System\ICASIaE.exe
  C:\Windows\System\ICASIaE.exe
  2⤵
  PID:5836
- C:\Windows\System\XnJVARv.exe
  C:\Windows\System\XnJVARv.exe
  2⤵
  PID:5852
- C:\Windows\System\ktcQKzd.exe
  C:\Windows\System\ktcQKzd.exe
  2⤵
  PID:5868
- C:\Windows\System\VKKSluC.exe
  C:\Windows\System\VKKSluC.exe
  2⤵
  PID:5884
- C:\Windows\System\XwcqRQe.exe
  C:\Windows\System\XwcqRQe.exe
  2⤵
  PID:5900
- C:\Windows\System\ZLaoAPZ.exe
  C:\Windows\System\ZLaoAPZ.exe
  2⤵
  PID:5916
- C:\Windows\System\WxTwPYy.exe
  C:\Windows\System\WxTwPYy.exe
  2⤵
  PID:5932
- C:\Windows\System\PASjqrE.exe
  C:\Windows\System\PASjqrE.exe
  2⤵
  PID:5948
- C:\Windows\System\OObSvjt.exe
  C:\Windows\System\OObSvjt.exe
  2⤵
  PID:5964
- C:\Windows\System\xuQLWDG.exe
  C:\Windows\System\xuQLWDG.exe
  2⤵
  PID:5980
- C:\Windows\System\syoTWje.exe
  C:\Windows\System\syoTWje.exe
  2⤵
  PID:5996
- C:\Windows\System\jYBFLMZ.exe
  C:\Windows\System\jYBFLMZ.exe
  2⤵
  PID:6012
- C:\Windows\System\pzbWprG.exe
  C:\Windows\System\pzbWprG.exe
  2⤵
  PID:6028
- C:\Windows\System\KaozkwM.exe
  C:\Windows\System\KaozkwM.exe
  2⤵
  PID:6044
- C:\Windows\System\PCocwfe.exe
  C:\Windows\System\PCocwfe.exe
  2⤵
  PID:6060
- C:\Windows\System\IgTttXi.exe
  C:\Windows\System\IgTttXi.exe
  2⤵
  PID:6076
- C:\Windows\System\dzzmuIE.exe
  C:\Windows\System\dzzmuIE.exe
  2⤵
  PID:6092
- C:\Windows\System\jpOSbWp.exe
  C:\Windows\System\jpOSbWp.exe
  2⤵
  PID:6108
- C:\Windows\System\RkwGPjw.exe
  C:\Windows\System\RkwGPjw.exe
  2⤵
  PID:6124
- C:\Windows\System\TFUJmoc.exe
  C:\Windows\System\TFUJmoc.exe
  2⤵
  PID:6140
- C:\Windows\System\EuCkyOS.exe
  C:\Windows\System\EuCkyOS.exe
  2⤵
  PID:5008
- C:\Windows\System\dWSWGuD.exe
  C:\Windows\System\dWSWGuD.exe
  2⤵
  PID:5168
- C:\Windows\System\TjYecUi.exe
  C:\Windows\System\TjYecUi.exe
  2⤵
  PID:5268
- C:\Windows\System\kONDmfn.exe
  C:\Windows\System\kONDmfn.exe
  2⤵
  PID:5332
- C:\Windows\System\IRMMVgg.exe
  C:\Windows\System\IRMMVgg.exe
  2⤵
  PID:5396
- C:\Windows\System\HSDbHwP.exe
  C:\Windows\System\HSDbHwP.exe
  2⤵
  PID:5488
- C:\Windows\System\wIlcUjw.exe
  C:\Windows\System\wIlcUjw.exe
  2⤵
  PID:5552
- C:\Windows\System\rBzCHuE.exe
  C:\Windows\System\rBzCHuE.exe
  2⤵
  PID:5584
- C:\Windows\System\kHiDZTf.exe
  C:\Windows\System\kHiDZTf.exe
  2⤵
  PID:5656
- C:\Windows\System\JPsBbbj.exe
  C:\Windows\System\JPsBbbj.exe
  2⤵
  PID:5672
- C:\Windows\System\fzflguw.exe
  C:\Windows\System\fzflguw.exe
  2⤵
  PID:5688
- C:\Windows\System\pvsqoil.exe
  C:\Windows\System\pvsqoil.exe
  2⤵
  PID:5700
- C:\Windows\System\tuIfeat.exe
  C:\Windows\System\tuIfeat.exe
  2⤵
  PID:5720
- C:\Windows\System\FziDFiC.exe
  C:\Windows\System\FziDFiC.exe
  2⤵
  PID:4520
- C:\Windows\System\NFAvmaV.exe
  C:\Windows\System\NFAvmaV.exe
  2⤵
  PID:4728
- C:\Windows\System\nhyAbHO.exe
  C:\Windows\System\nhyAbHO.exe
  2⤵
  PID:2812
- C:\Windows\System\IjtkOVN.exe
  C:\Windows\System\IjtkOVN.exe
  2⤵
  PID:4160
- C:\Windows\System\oDEVGXL.exe
  C:\Windows\System\oDEVGXL.exe
  2⤵
  PID:4324
- C:\Windows\System\vJieXYL.exe
  C:\Windows\System\vJieXYL.exe
  2⤵
  PID:4456
- C:\Windows\System\MZJraDF.exe
  C:\Windows\System\MZJraDF.exe
  2⤵
  PID:4524
- C:\Windows\System\sjgUoGx.exe
  C:\Windows\System\sjgUoGx.exe
  2⤵
  PID:3524
- C:\Windows\System\JQAIUhs.exe
  C:\Windows\System\JQAIUhs.exe
  2⤵
  PID:4644
- C:\Windows\System\LBqaThg.exe
  C:\Windows\System\LBqaThg.exe
  2⤵
  PID:3904
- C:\Windows\System\rIXknih.exe
  C:\Windows\System\rIXknih.exe
  2⤵
  PID:4596
- C:\Windows\System\phDuTXD.exe
  C:\Windows\System\phDuTXD.exe
  2⤵
  PID:4904
- C:\Windows\System\nFrPkyS.exe
  C:\Windows\System\nFrPkyS.exe
  2⤵
  PID:4928
- C:\Windows\System\FwhKBPk.exe
  C:\Windows\System\FwhKBPk.exe
  2⤵
  PID:5088
- C:\Windows\System\ozNLxYG.exe
  C:\Windows\System\ozNLxYG.exe
  2⤵
  PID:2460
- C:\Windows\System\meBQVMu.exe
  C:\Windows\System\meBQVMu.exe
  2⤵
  PID:3216
- C:\Windows\System\UnCVJRf.exe
  C:\Windows\System\UnCVJRf.exe
  2⤵
  PID:2676
- C:\Windows\System\EWGqKcq.exe
  C:\Windows\System\EWGqKcq.exe
  2⤵
  PID:3780
- C:\Windows\System\UoYnENx.exe
  C:\Windows\System\UoYnENx.exe
  2⤵
  PID:3604
- C:\Windows\System\bmWbVQL.exe
  C:\Windows\System\bmWbVQL.exe
  2⤵
  PID:4340
- C:\Windows\System\fIdeAkq.exe
  C:\Windows\System\fIdeAkq.exe
  2⤵
  PID:4472
- C:\Windows\System\aHNXGFK.exe
  C:\Windows\System\aHNXGFK.exe
  2⤵
  PID:4308
- C:\Windows\System\KsAOXTz.exe
  C:\Windows\System\KsAOXTz.exe
  2⤵
  PID:5440
- C:\Windows\System\wfVaMJj.exe
  C:\Windows\System\wfVaMJj.exe
  2⤵
  PID:5540
- C:\Windows\System\WwGkaXU.exe
  C:\Windows\System\WwGkaXU.exe
  2⤵
  PID:5744
- C:\Windows\System\ImlWvdw.exe
  C:\Windows\System\ImlWvdw.exe
  2⤵
  PID:2836
- C:\Windows\System\KjRHLQb.exe
  C:\Windows\System\KjRHLQb.exe
  2⤵
  PID:2044
- C:\Windows\System\ofnJUSv.exe
  C:\Windows\System\ofnJUSv.exe
  2⤵
  PID:5960
- C:\Windows\System\wdTharw.exe
  C:\Windows\System\wdTharw.exe
  2⤵
  PID:6120
- C:\Windows\System\QhdhJWx.exe
  C:\Windows\System\QhdhJWx.exe
  2⤵
  PID:5264
- C:\Windows\System\junLHDB.exe
  C:\Windows\System\junLHDB.exe
  2⤵
  PID:1844
- C:\Windows\System\SCVozOh.exe
  C:\Windows\System\SCVozOh.exe
  2⤵
  PID:5708
- C:\Windows\System\usadtHc.exe
  C:\Windows\System\usadtHc.exe
  2⤵
  PID:2924
- C:\Windows\System\pzLIARw.exe
  C:\Windows\System\pzLIARw.exe
  2⤵
  PID:1984
- C:\Windows\System\HSOHYXZ.exe
  C:\Windows\System\HSOHYXZ.exe
  2⤵
  PID:1524
- C:\Windows\System\OigipaQ.exe
  C:\Windows\System\OigipaQ.exe
  2⤵
  PID:5136
- C:\Windows\System\PwaaVon.exe
  C:\Windows\System\PwaaVon.exe
  2⤵
  PID:4424
- C:\Windows\System\SUBEvZZ.exe
  C:\Windows\System\SUBEvZZ.exe
  2⤵
  PID:5616
- C:\Windows\System\hGvkPCX.exe
  C:\Windows\System\hGvkPCX.exe
  2⤵
  PID:5668
- C:\Windows\System\WEJhpNb.exe
  C:\Windows\System\WEJhpNb.exe
  2⤵
  PID:5844
- C:\Windows\System\BLAASlO.exe
  C:\Windows\System\BLAASlO.exe
  2⤵
  PID:5912
- C:\Windows\System\ICztnaY.exe
  C:\Windows\System\ICztnaY.exe
  2⤵
  PID:6004
- C:\Windows\System\raZEiNf.exe
  C:\Windows\System\raZEiNf.exe
  2⤵
  PID:6040
- C:\Windows\System\DABfNVZ.exe
  C:\Windows\System\DABfNVZ.exe
  2⤵
  PID:5300
- C:\Windows\System\kLANbKO.exe
  C:\Windows\System\kLANbKO.exe
  2⤵
  PID:1668
- C:\Windows\System\rQLOFLM.exe
  C:\Windows\System\rQLOFLM.exe
  2⤵
  PID:1704
- C:\Windows\System\mwCumEG.exe
  C:\Windows\System\mwCumEG.exe
  2⤵
  PID:3396
- C:\Windows\System\qPaLLVq.exe
  C:\Windows\System\qPaLLVq.exe
  2⤵
  PID:4580
- C:\Windows\System\rHsyAix.exe
  C:\Windows\System\rHsyAix.exe
  2⤵
  PID:4292
- C:\Windows\System\dUVvJfo.exe
  C:\Windows\System\dUVvJfo.exe
  2⤵
  PID:4488
- C:\Windows\System\MKQyGHe.exe
  C:\Windows\System\MKQyGHe.exe
  2⤵
  PID:4180
- C:\Windows\System\BhJtiae.exe
  C:\Windows\System\BhJtiae.exe
  2⤵
  PID:4924
- C:\Windows\System\PCryyeN.exe
  C:\Windows\System\PCryyeN.exe
  2⤵
  PID:1876
- C:\Windows\System\zZaEfkY.exe
  C:\Windows\System\zZaEfkY.exe
  2⤵
  PID:3520
- C:\Windows\System\Zipdgcb.exe
  C:\Windows\System\Zipdgcb.exe
  2⤵
  PID:4664
- C:\Windows\System\csrcKAd.exe
  C:\Windows\System\csrcKAd.exe
  2⤵
  PID:5188
- C:\Windows\System\NZVyzRH.exe
  C:\Windows\System\NZVyzRH.exe
  2⤵
  PID:5220
- C:\Windows\System\wExPJMu.exe
  C:\Windows\System\wExPJMu.exe
  2⤵
  PID:5408
- C:\Windows\System\GolMLTj.exe
  C:\Windows\System\GolMLTj.exe
  2⤵
  PID:5376
- C:\Windows\System\ZTzPWpL.exe
  C:\Windows\System\ZTzPWpL.exe
  2⤵
  PID:5280
- C:\Windows\System\gEVlONy.exe
  C:\Windows\System\gEVlONy.exe
  2⤵
  PID:5740
- C:\Windows\System\vPeAXTs.exe
  C:\Windows\System\vPeAXTs.exe
  2⤵
  PID:1648
- C:\Windows\System\sgMrxMB.exe
  C:\Windows\System\sgMrxMB.exe
  2⤵
  PID:3020
- C:\Windows\System\qBTelau.exe
  C:\Windows\System\qBTelau.exe
  2⤵
  PID:5768
- C:\Windows\System\gUXlwtB.exe
  C:\Windows\System\gUXlwtB.exe
  2⤵
  PID:5788
- C:\Windows\System\IkxrHbD.exe
  C:\Windows\System\IkxrHbD.exe
  2⤵
  PID:5812
- C:\Windows\System\iRIPcWE.exe
  C:\Windows\System\iRIPcWE.exe
  2⤵
  PID:2716
- C:\Windows\System\duRcJuL.exe
  C:\Windows\System\duRcJuL.exe
  2⤵
  PID:4552
- C:\Windows\System\BfAcjgW.exe
  C:\Windows\System\BfAcjgW.exe
  2⤵
  PID:5928
- C:\Windows\System\uLXQuJb.exe
  C:\Windows\System\uLXQuJb.exe
  2⤵
  PID:6056
- C:\Windows\System\FJpwGYA.exe
  C:\Windows\System\FJpwGYA.exe
  2⤵
  PID:5200
- C:\Windows\System\uuEnYlL.exe
  C:\Windows\System\uuEnYlL.exe
  2⤵
  PID:5648
- C:\Windows\System\njuRrrv.exe
  C:\Windows\System\njuRrrv.exe
  2⤵
  PID:5524
- C:\Windows\System\ropGRlg.exe
  C:\Windows\System\ropGRlg.exe
  2⤵
  PID:5084
- C:\Windows\System\DGCcmWw.exe
  C:\Windows\System\DGCcmWw.exe
  2⤵
  PID:3376
- C:\Windows\System\zRpuMSr.exe
  C:\Windows\System\zRpuMSr.exe
  2⤵
  PID:5184
- C:\Windows\System\hfxsASi.exe
  C:\Windows\System\hfxsASi.exe
  2⤵
  PID:5732
- C:\Windows\System\SnhcAZZ.exe
  C:\Windows\System\SnhcAZZ.exe
  2⤵
  PID:5536
- C:\Windows\System\mHFOMmU.exe
  C:\Windows\System\mHFOMmU.exe
  2⤵
  PID:5780
- C:\Windows\System\VJbnacZ.exe
  C:\Windows\System\VJbnacZ.exe
  2⤵
  PID:1064
- C:\Windows\System\gpBnDph.exe
  C:\Windows\System\gpBnDph.exe
  2⤵
  PID:5956
- C:\Windows\System\ebREnbp.exe
  C:\Windows\System\ebREnbp.exe
  2⤵
  PID:4476
- C:\Windows\System\Leybmqt.exe
  C:\Windows\System\Leybmqt.exe
  2⤵
  PID:3168
- C:\Windows\System\qHQZFLC.exe
  C:\Windows\System\qHQZFLC.exe
  2⤵
  PID:972
- C:\Windows\System\wLioBgI.exe
  C:\Windows\System\wLioBgI.exe
  2⤵
  PID:5800
- C:\Windows\System\hwfuVlo.exe
  C:\Windows\System\hwfuVlo.exe
  2⤵
  PID:5456
- C:\Windows\System\Ztzxkvn.exe
  C:\Windows\System\Ztzxkvn.exe
  2⤵
  PID:6104
- C:\Windows\System\VThRvWz.exe
  C:\Windows\System\VThRvWz.exe
  2⤵
  PID:1672
- C:\Windows\System\qxDClzg.exe
  C:\Windows\System\qxDClzg.exe
  2⤵
  PID:4376
- C:\Windows\System\VeVfZTr.exe
  C:\Windows\System\VeVfZTr.exe
  2⤵
  PID:4000
- C:\Windows\System\YUTLDmT.exe
  C:\Windows\System\YUTLDmT.exe
  2⤵
  PID:1752
- C:\Windows\System\xnsjDUB.exe
  C:\Windows\System\xnsjDUB.exe
  2⤵
  PID:5860
- C:\Windows\System\AjSgPjt.exe
  C:\Windows\System\AjSgPjt.exe
  2⤵
  PID:5896
- C:\Windows\System\MFtDydp.exe
  C:\Windows\System\MFtDydp.exe
  2⤵
  PID:6024
- C:\Windows\System\ujwKpir.exe
  C:\Windows\System\ujwKpir.exe
  2⤵
  PID:4548
- C:\Windows\System\zoEAnFI.exe
  C:\Windows\System\zoEAnFI.exe
  2⤵
  PID:5232
- C:\Windows\System\FEApcXs.exe
  C:\Windows\System\FEApcXs.exe
  2⤵
  PID:3540
- C:\Windows\System\LZCsMYF.exe
  C:\Windows\System\LZCsMYF.exe
  2⤵
  PID:412
- C:\Windows\System\HfmOnEO.exe
  C:\Windows\System\HfmOnEO.exe
  2⤵
  PID:6160
- C:\Windows\System\pjmroqm.exe
  C:\Windows\System\pjmroqm.exe
  2⤵
  PID:6176
- C:\Windows\System\GTRrrej.exe
  C:\Windows\System\GTRrrej.exe
  2⤵
  PID:6192
- C:\Windows\System\EhPTmFV.exe
  C:\Windows\System\EhPTmFV.exe
  2⤵
  PID:6208
- C:\Windows\System\QPeyKqa.exe
  C:\Windows\System\QPeyKqa.exe
  2⤵
  PID:6224
- C:\Windows\System\IAjTYbP.exe
  C:\Windows\System\IAjTYbP.exe
  2⤵
  PID:6240
- C:\Windows\System\icCaYqI.exe
  C:\Windows\System\icCaYqI.exe
  2⤵
  PID:6256
- C:\Windows\System\IcyNzzN.exe
  C:\Windows\System\IcyNzzN.exe
  2⤵
  PID:6272
- C:\Windows\System\rHMdRpy.exe
  C:\Windows\System\rHMdRpy.exe
  2⤵
  PID:6288
- C:\Windows\System\tJwpvhS.exe
  C:\Windows\System\tJwpvhS.exe
  2⤵
  PID:6304
- C:\Windows\System\DqLFVQO.exe
  C:\Windows\System\DqLFVQO.exe
  2⤵
  PID:6320
- C:\Windows\System\ZMFvypM.exe
  C:\Windows\System\ZMFvypM.exe
  2⤵
  PID:6336
- C:\Windows\System\IQaTeTS.exe
  C:\Windows\System\IQaTeTS.exe
  2⤵
  PID:6352
- C:\Windows\System\IRkLvxa.exe
  C:\Windows\System\IRkLvxa.exe
  2⤵
  PID:6368
- C:\Windows\System\TsfqvvB.exe
  C:\Windows\System\TsfqvvB.exe
  2⤵
  PID:6384
- C:\Windows\System\IIOsltm.exe
  C:\Windows\System\IIOsltm.exe
  2⤵
  PID:6400
- C:\Windows\System\IVDtrCB.exe
  C:\Windows\System\IVDtrCB.exe
  2⤵
  PID:6416
- C:\Windows\System\mIxjhUg.exe
  C:\Windows\System\mIxjhUg.exe
  2⤵
  PID:6432
- C:\Windows\System\DTqsLmQ.exe
  C:\Windows\System\DTqsLmQ.exe
  2⤵
  PID:6448
- C:\Windows\System\SpAFZDn.exe
  C:\Windows\System\SpAFZDn.exe
  2⤵
  PID:6464
- C:\Windows\System\NFuEvfz.exe
  C:\Windows\System\NFuEvfz.exe
  2⤵
  PID:6480
- C:\Windows\System\aVILHHH.exe
  C:\Windows\System\aVILHHH.exe
  2⤵
  PID:6496
- C:\Windows\System\XIgRRoX.exe
  C:\Windows\System\XIgRRoX.exe
  2⤵
  PID:6512
- C:\Windows\System\FcqCjOX.exe
  C:\Windows\System\FcqCjOX.exe
  2⤵
  PID:6528
- C:\Windows\System\UoGtkwL.exe
  C:\Windows\System\UoGtkwL.exe
  2⤵
  PID:6544
- C:\Windows\System\SSpHyMD.exe
  C:\Windows\System\SSpHyMD.exe
  2⤵
  PID:6560
- C:\Windows\System\paiYNGZ.exe
  C:\Windows\System\paiYNGZ.exe
  2⤵
  PID:6576
- C:\Windows\System\RsfOyIy.exe
  C:\Windows\System\RsfOyIy.exe
  2⤵
  PID:6592
- C:\Windows\System\HtJQsQM.exe
  C:\Windows\System\HtJQsQM.exe
  2⤵
  PID:6608
- C:\Windows\System\NmKQFVd.exe
  C:\Windows\System\NmKQFVd.exe
  2⤵
  PID:6624
- C:\Windows\System\XUlXseu.exe
  C:\Windows\System\XUlXseu.exe
  2⤵
  PID:6640
- C:\Windows\System\kkzMaNI.exe
  C:\Windows\System\kkzMaNI.exe
  2⤵
  PID:6656
- C:\Windows\System\jrBFBFE.exe
  C:\Windows\System\jrBFBFE.exe
  2⤵
  PID:6672
- C:\Windows\System\OAllqEc.exe
  C:\Windows\System\OAllqEc.exe
  2⤵
  PID:6688
- C:\Windows\System\TdWOFVe.exe
  C:\Windows\System\TdWOFVe.exe
  2⤵
  PID:6704
- C:\Windows\System\rbwYqFj.exe
  C:\Windows\System\rbwYqFj.exe
  2⤵
  PID:6720
- C:\Windows\System\KFyqwnK.exe
  C:\Windows\System\KFyqwnK.exe
  2⤵
  PID:6736
- C:\Windows\System\lfLcttJ.exe
  C:\Windows\System\lfLcttJ.exe
  2⤵
  PID:6752
- C:\Windows\System\hmeLkyB.exe
  C:\Windows\System\hmeLkyB.exe
  2⤵
  PID:6768
- C:\Windows\System\HLqYFfr.exe
  C:\Windows\System\HLqYFfr.exe
  2⤵
  PID:6784
- C:\Windows\System\JtJfdin.exe
  C:\Windows\System\JtJfdin.exe
  2⤵
  PID:6800
- C:\Windows\System\xedmrOS.exe
  C:\Windows\System\xedmrOS.exe
  2⤵
  PID:6816
- C:\Windows\System\mPpwFdk.exe
  C:\Windows\System\mPpwFdk.exe
  2⤵
  PID:6852
- C:\Windows\System\BvxQPBj.exe
  C:\Windows\System\BvxQPBj.exe
  2⤵
  PID:6872
- C:\Windows\System\wnZmEdY.exe
  C:\Windows\System\wnZmEdY.exe
  2⤵
  PID:6888
- C:\Windows\System\XOVkLQt.exe
  C:\Windows\System\XOVkLQt.exe
  2⤵
  PID:6924
- C:\Windows\System\YSwCDXm.exe
  C:\Windows\System\YSwCDXm.exe
  2⤵
  PID:6940
- C:\Windows\System\YxpBnIP.exe
  C:\Windows\System\YxpBnIP.exe
  2⤵
  PID:6968
- C:\Windows\System\PdPWhXj.exe
  C:\Windows\System\PdPWhXj.exe
  2⤵
  PID:6984
- C:\Windows\System\hXqrjwM.exe
  C:\Windows\System\hXqrjwM.exe
  2⤵
  PID:7000
- C:\Windows\System\LbdDhws.exe
  C:\Windows\System\LbdDhws.exe
  2⤵
  PID:7016
- C:\Windows\System\medIrjU.exe
  C:\Windows\System\medIrjU.exe
  2⤵
  PID:7036
- C:\Windows\System\vfGIOJe.exe
  C:\Windows\System\vfGIOJe.exe
  2⤵
  PID:7052
- C:\Windows\System\QlgXKwX.exe
  C:\Windows\System\QlgXKwX.exe
  2⤵
  PID:7068
- C:\Windows\System\LCRSzAf.exe
  C:\Windows\System\LCRSzAf.exe
  2⤵
  PID:7084
- C:\Windows\System\WhPVtCC.exe
  C:\Windows\System\WhPVtCC.exe
  2⤵
  PID:7100
- C:\Windows\System\lYoOgak.exe
  C:\Windows\System\lYoOgak.exe
  2⤵
  PID:7120
- C:\Windows\System\SmfeUwS.exe
  C:\Windows\System\SmfeUwS.exe
  2⤵
  PID:7136
- C:\Windows\System\KeRjvWT.exe
  C:\Windows\System\KeRjvWT.exe
  2⤵
  PID:7152
- C:\Windows\System\XzEMYol.exe
  C:\Windows\System\XzEMYol.exe
  2⤵
  PID:5924
- C:\Windows\System\tHqmJnv.exe
  C:\Windows\System\tHqmJnv.exe
  2⤵
  PID:5736
- C:\Windows\System\VjHnbIP.exe
  C:\Windows\System\VjHnbIP.exe
  2⤵
  PID:2416
- C:\Windows\System\cFfNupH.exe
  C:\Windows\System\cFfNupH.exe
  2⤵
  PID:5804
- C:\Windows\System\YmHtNKe.exe
  C:\Windows\System\YmHtNKe.exe
  2⤵
  PID:5944
- C:\Windows\System\RuMLSgs.exe
  C:\Windows\System\RuMLSgs.exe
  2⤵
  PID:3152
- C:\Windows\System\MzdsEXP.exe
  C:\Windows\System\MzdsEXP.exe
  2⤵
  PID:6088
- C:\Windows\System\oLDWgzQ.exe
  C:\Windows\System\oLDWgzQ.exe
  2⤵
  PID:6156
- C:\Windows\System\gIPxipK.exe
  C:\Windows\System\gIPxipK.exe
  2⤵
  PID:6220
- C:\Windows\System\Klmsbsf.exe
  C:\Windows\System\Klmsbsf.exe
  2⤵
  PID:6284
- C:\Windows\System\MFTwEYc.exe
  C:\Windows\System\MFTwEYc.exe
  2⤵
  PID:6348
- C:\Windows\System\ukoBYUm.exe
  C:\Windows\System\ukoBYUm.exe
  2⤵
  PID:6036
- C:\Windows\System\IDnEwCR.exe
  C:\Windows\System\IDnEwCR.exe
  2⤵
  PID:6408
- C:\Windows\System\MxVdAFX.exe
  C:\Windows\System\MxVdAFX.exe
  2⤵
  PID:6472
- C:\Windows\System\nlEwIGz.exe
  C:\Windows\System\nlEwIGz.exe
  2⤵
  PID:6536
- C:\Windows\System\BKZQEdO.exe
  C:\Windows\System\BKZQEdO.exe
  2⤵
  PID:6600
- C:\Windows\System\GhqPDIF.exe
  C:\Windows\System\GhqPDIF.exe
  2⤵
  PID:6696
- C:\Windows\System\OrDFjHM.exe
  C:\Windows\System\OrDFjHM.exe
  2⤵
  PID:3048
- C:\Windows\System\pJiZkhb.exe
  C:\Windows\System\pJiZkhb.exe
  2⤵
  PID:5908
- C:\Windows\System\vBXTXWo.exe
  C:\Windows\System\vBXTXWo.exe
  2⤵
  PID:5784
- C:\Windows\System\AXBSrdn.exe
  C:\Windows\System\AXBSrdn.exe
  2⤵
  PID:2096
- C:\Windows\System\RaarscB.exe
  C:\Windows\System\RaarscB.exe
  2⤵
  PID:4016
- C:\Windows\System\cerOOYV.exe
  C:\Windows\System\cerOOYV.exe
  2⤵
  PID:5816
- C:\Windows\System\VmFFbqk.exe
  C:\Windows\System\VmFFbqk.exe
  2⤵
  PID:5828
- C:\Windows\System\iapwsOD.exe
  C:\Windows\System\iapwsOD.exe
  2⤵
  PID:6068
- C:\Windows\System\mFIDtPx.exe
  C:\Windows\System\mFIDtPx.exe
  2⤵
  PID:6132
- C:\Windows\System\GwQEgTS.exe
  C:\Windows\System\GwQEgTS.exe
  2⤵
  PID:6300
- C:\Windows\System\pitVlwd.exe
  C:\Windows\System\pitVlwd.exe
  2⤵
  PID:6364
- C:\Windows\System\mvMukWj.exe
  C:\Windows\System\mvMukWj.exe
  2⤵
  PID:2328
- C:\Windows\System\kfTtYFF.exe
  C:\Windows\System\kfTtYFF.exe
  2⤵
  PID:6460
- C:\Windows\System\fZMQoMZ.exe
  C:\Windows\System\fZMQoMZ.exe
  2⤵
  PID:5876
- C:\Windows\System\hmypTDC.exe
  C:\Windows\System\hmypTDC.exe
  2⤵
  PID:5880
- C:\Windows\System\RqYuCkO.exe
  C:\Windows\System\RqYuCkO.exe
  2⤵
  PID:6796
- C:\Windows\System\KhcOtai.exe
  C:\Windows\System\KhcOtai.exe
  2⤵
  PID:6836
- C:\Windows\System\fQhAlPC.exe
  C:\Windows\System\fQhAlPC.exe
  2⤵
  PID:5216
- C:\Windows\System\iJVyOob.exe
  C:\Windows\System\iJVyOob.exe
  2⤵
  PID:6332
- C:\Windows\System\MbWlaRJ.exe
  C:\Windows\System\MbWlaRJ.exe
  2⤵
  PID:6896
- C:\Windows\System\jrlaeHc.exe
  C:\Windows\System\jrlaeHc.exe
  2⤵
  PID:6916
- C:\Windows\System\Mnzjykd.exe
  C:\Windows\System\Mnzjykd.exe
  2⤵
  PID:6960
- C:\Windows\System\sEMreiA.exe
  C:\Windows\System\sEMreiA.exe
  2⤵
  PID:6996
- C:\Windows\System\iRcTZcN.exe
  C:\Windows\System\iRcTZcN.exe
  2⤵
  PID:7060
- C:\Windows\System\qEIokwL.exe
  C:\Windows\System\qEIokwL.exe
  2⤵
  PID:7128
- C:\Windows\System\CZeoHIp.exe
  C:\Windows\System\CZeoHIp.exe
  2⤵
  PID:4820
- C:\Windows\System\AEbWPzn.exe
  C:\Windows\System\AEbWPzn.exe
  2⤵
  PID:5808
- C:\Windows\System\DlvyTPk.exe
  C:\Windows\System\DlvyTPk.exe
  2⤵
  PID:6188
- C:\Windows\System\yKawxpI.exe
  C:\Windows\System\yKawxpI.exe
  2⤵
  PID:6632
- C:\Windows\System\jSlrhMx.exe
  C:\Windows\System\jSlrhMx.exe
  2⤵
  PID:6636
- C:\Windows\System\tQtamMP.exe
  C:\Windows\System\tQtamMP.exe
  2⤵
  PID:4804
- C:\Windows\System\XpnHbCe.exe
  C:\Windows\System\XpnHbCe.exe
  2⤵
  PID:988
- C:\Windows\System\SafKDHU.exe
  C:\Windows\System\SafKDHU.exe
  2⤵
  PID:6172
- C:\Windows\System\LhOwUEK.exe
  C:\Windows\System\LhOwUEK.exe
  2⤵
  PID:6396
- C:\Windows\System\kLZNpfX.exe
  C:\Windows\System\kLZNpfX.exe
  2⤵
  PID:6616
- C:\Windows\System\NmCEkrL.exe
  C:\Windows\System\NmCEkrL.exe
  2⤵
  PID:6680
- C:\Windows\System\quHIEjV.exe
  C:\Windows\System\quHIEjV.exe
  2⤵
  PID:6712
- C:\Windows\System\BkaObHV.exe
  C:\Windows\System\BkaObHV.exe
  2⤵
  PID:4492
- C:\Windows\System\dATRCQk.exe
  C:\Windows\System\dATRCQk.exe
  2⤵
  PID:6844
- C:\Windows\System\GqmVCiF.exe
  C:\Windows\System\GqmVCiF.exe
  2⤵
  PID:6556
- C:\Windows\System\eXrPnIQ.exe
  C:\Windows\System\eXrPnIQ.exe
  2⤵
  PID:6880
- C:\Windows\System\ZxCXBwx.exe
  C:\Windows\System\ZxCXBwx.exe
  2⤵
  PID:6976
- C:\Windows\System\reQaOnl.exe
  C:\Windows\System\reQaOnl.exe
  2⤵
  PID:7048
- C:\Windows\System\rheXafz.exe
  C:\Windows\System\rheXafz.exe
  2⤵
  PID:7144
- C:\Windows\System\AVUDcfS.exe
  C:\Windows\System\AVUDcfS.exe
  2⤵
  PID:3004
- C:\Windows\System\YdylHBn.exe
  C:\Windows\System\YdylHBn.exe
  2⤵
  PID:864
- C:\Windows\System\CySUsxG.exe
  C:\Windows\System\CySUsxG.exe
  2⤵
  PID:6280
- C:\Windows\System\kGzodir.exe
  C:\Windows\System\kGzodir.exe
  2⤵
  PID:6840
- C:\Windows\System\YLxGgST.exe
  C:\Windows\System\YLxGgST.exe
  2⤵
  PID:3264
- C:\Windows\System\mUwwbfk.exe
  C:\Windows\System\mUwwbfk.exe
  2⤵
  PID:6964
- C:\Windows\System\DADnZoJ.exe
  C:\Windows\System\DADnZoJ.exe
  2⤵
  PID:2196
- C:\Windows\System\afQHVxZ.exe
  C:\Windows\System\afQHVxZ.exe
  2⤵
  PID:5284
- C:\Windows\System\pHmrloL.exe
  C:\Windows\System\pHmrloL.exe
  2⤵
  PID:6652
- C:\Windows\System\oHZGPKG.exe
  C:\Windows\System\oHZGPKG.exe
  2⤵
  PID:2188
- C:\Windows\System\QyskaLy.exe
  C:\Windows\System\QyskaLy.exe
  2⤵
  PID:7112
- C:\Windows\System\yZOZpwU.exe
  C:\Windows\System\yZOZpwU.exe
  2⤵
  PID:6792
- C:\Windows\System\lunuSwA.exe
  C:\Windows\System\lunuSwA.exe
  2⤵
  PID:7180
- C:\Windows\System\fQvDzBy.exe
  C:\Windows\System\fQvDzBy.exe
  2⤵
  PID:7264
- C:\Windows\System\mEngOTT.exe
  C:\Windows\System\mEngOTT.exe
  2⤵
  PID:7280
- C:\Windows\System\sZVFrex.exe
  C:\Windows\System\sZVFrex.exe
  2⤵
  PID:7296
- C:\Windows\System\DAyAXAY.exe
  C:\Windows\System\DAyAXAY.exe
  2⤵
  PID:7312
- C:\Windows\System\JdtUGFP.exe
  C:\Windows\System\JdtUGFP.exe
  2⤵
  PID:7328
- C:\Windows\System\lcORrBX.exe
  C:\Windows\System\lcORrBX.exe
  2⤵
  PID:7344
- C:\Windows\System\AweRdyn.exe
  C:\Windows\System\AweRdyn.exe
  2⤵
  PID:7360
- C:\Windows\System\UzBATdV.exe
  C:\Windows\System\UzBATdV.exe
  2⤵
  PID:7376
- C:\Windows\System\wKSjJdB.exe
  C:\Windows\System\wKSjJdB.exe
  2⤵
  PID:7392
- C:\Windows\System\rWVsqzq.exe
  C:\Windows\System\rWVsqzq.exe
  2⤵
  PID:7408
- C:\Windows\System\ICFFkmg.exe
  C:\Windows\System\ICFFkmg.exe
  2⤵
  PID:7424
- C:\Windows\System\VrnwZjT.exe
  C:\Windows\System\VrnwZjT.exe
  2⤵
  PID:7440
- C:\Windows\System\xwNdNBO.exe
  C:\Windows\System\xwNdNBO.exe
  2⤵
  PID:7456
- C:\Windows\System\qabBUKF.exe
  C:\Windows\System\qabBUKF.exe
  2⤵
  PID:7472
- C:\Windows\System\tMGCGsh.exe
  C:\Windows\System\tMGCGsh.exe
  2⤵
  PID:7488
- C:\Windows\System\rXvHBFz.exe
  C:\Windows\System\rXvHBFz.exe
  2⤵
  PID:7504
- C:\Windows\System\IooIBZf.exe
  C:\Windows\System\IooIBZf.exe
  2⤵
  PID:7520
- C:\Windows\System\ooLBwub.exe
  C:\Windows\System\ooLBwub.exe
  2⤵
  PID:7536
- C:\Windows\System\LCorzgG.exe
  C:\Windows\System\LCorzgG.exe
  2⤵
  PID:7552
- C:\Windows\System\pXjjIdg.exe
  C:\Windows\System\pXjjIdg.exe
  2⤵
  PID:7568
- C:\Windows\System\YURhIuP.exe
  C:\Windows\System\YURhIuP.exe
  2⤵
  PID:7584
- C:\Windows\System\GjFNSML.exe
  C:\Windows\System\GjFNSML.exe
  2⤵
  PID:7600
- C:\Windows\System\rXYxZUC.exe
  C:\Windows\System\rXYxZUC.exe
  2⤵
  PID:7616
- C:\Windows\System\tRHhByz.exe
  C:\Windows\System\tRHhByz.exe
  2⤵
  PID:7632
- C:\Windows\System\ukuXBCT.exe
  C:\Windows\System\ukuXBCT.exe
  2⤵
  PID:7648
- C:\Windows\System\BAlmzgf.exe
  C:\Windows\System\BAlmzgf.exe
  2⤵
  PID:7664
- C:\Windows\System\EqCzVDc.exe
  C:\Windows\System\EqCzVDc.exe
  2⤵
  PID:7680
- C:\Windows\System\Yogyrde.exe
  C:\Windows\System\Yogyrde.exe
  2⤵
  PID:7696
- C:\Windows\System\pRNBPGU.exe
  C:\Windows\System\pRNBPGU.exe
  2⤵
  PID:7712
- C:\Windows\System\nVAmAiG.exe
  C:\Windows\System\nVAmAiG.exe
  2⤵
  PID:7728
- C:\Windows\System\vgPtFQD.exe
  C:\Windows\System\vgPtFQD.exe
  2⤵
  PID:7744
- C:\Windows\System\DSsnirH.exe
  C:\Windows\System\DSsnirH.exe
  2⤵
  PID:7760
- C:\Windows\System\uITGgSF.exe
  C:\Windows\System\uITGgSF.exe
  2⤵
  PID:7776
- C:\Windows\System\qCRSIpz.exe
  C:\Windows\System\qCRSIpz.exe
  2⤵
  PID:7792
- C:\Windows\System\DDedYgt.exe
  C:\Windows\System\DDedYgt.exe
  2⤵
  PID:7808
- C:\Windows\System\MgKgspS.exe
  C:\Windows\System\MgKgspS.exe
  2⤵
  PID:7824
- C:\Windows\System\xZzNJYW.exe
  C:\Windows\System\xZzNJYW.exe
  2⤵
  PID:7840
- C:\Windows\System\STYzXKT.exe
  C:\Windows\System\STYzXKT.exe
  2⤵
  PID:7856
- C:\Windows\System\DtlBCin.exe
  C:\Windows\System\DtlBCin.exe
  2⤵
  PID:7872
- C:\Windows\System\opeDQqz.exe
  C:\Windows\System\opeDQqz.exe
  2⤵
  PID:7888
- C:\Windows\System\NxKGRTF.exe
  C:\Windows\System\NxKGRTF.exe
  2⤵
  PID:7904
- C:\Windows\System\wzTJVEu.exe
  C:\Windows\System\wzTJVEu.exe
  2⤵
  PID:7920
- C:\Windows\System\ffFrjPs.exe
  C:\Windows\System\ffFrjPs.exe
  2⤵
  PID:7936
- C:\Windows\System\XleMETV.exe
  C:\Windows\System\XleMETV.exe
  2⤵
  PID:7952
- C:\Windows\System\kbfaxDB.exe
  C:\Windows\System\kbfaxDB.exe
  2⤵
  PID:7968
- C:\Windows\System\YcJOarO.exe
  C:\Windows\System\YcJOarO.exe
  2⤵
  PID:7984
- C:\Windows\System\vUxMpUj.exe
  C:\Windows\System\vUxMpUj.exe
  2⤵
  PID:8000
- C:\Windows\System\pAZTyNZ.exe
  C:\Windows\System\pAZTyNZ.exe
  2⤵
  PID:8016
- C:\Windows\System\oSTqxpM.exe
  C:\Windows\System\oSTqxpM.exe
  2⤵
  PID:8032
- C:\Windows\System\cxtqgYO.exe
  C:\Windows\System\cxtqgYO.exe
  2⤵
  PID:8048
- C:\Windows\System\wwaGuuI.exe
  C:\Windows\System\wwaGuuI.exe
  2⤵
  PID:8064
- C:\Windows\System\pwrmVDN.exe
  C:\Windows\System\pwrmVDN.exe
  2⤵
  PID:8080
- C:\Windows\System\FPrFAgS.exe
  C:\Windows\System\FPrFAgS.exe
  2⤵
  PID:8096
- C:\Windows\System\MRDTVLm.exe
  C:\Windows\System\MRDTVLm.exe
  2⤵
  PID:8116
- C:\Windows\System\wHMazUe.exe
  C:\Windows\System\wHMazUe.exe
  2⤵
  PID:8136
- C:\Windows\System\PvJPoei.exe
  C:\Windows\System\PvJPoei.exe
  2⤵
  PID:8156
- C:\Windows\System\sPNsrhe.exe
  C:\Windows\System\sPNsrhe.exe
  2⤵
  PID:8172
- C:\Windows\System\DIoVzhT.exe
  C:\Windows\System\DIoVzhT.exe
  2⤵
  PID:8188
- C:\Windows\System\YIPpbBw.exe
  C:\Windows\System\YIPpbBw.exe
  2⤵
  PID:5344
- C:\Windows\System\QlvSgYb.exe
  C:\Windows\System\QlvSgYb.exe
  2⤵
  PID:6508
- C:\Windows\System\PLvhvnN.exe
  C:\Windows\System\PLvhvnN.exe
  2⤵
  PID:7204
- C:\Windows\System\WVEtYXh.exe
  C:\Windows\System\WVEtYXh.exe
  2⤵
  PID:7220
- C:\Windows\System\mKBspzD.exe
  C:\Windows\System\mKBspzD.exe
  2⤵
  PID:5664
- C:\Windows\System\IeROUZw.exe
  C:\Windows\System\IeROUZw.exe
  2⤵
  PID:6568
- C:\Windows\System\IRixSxZ.exe
  C:\Windows\System\IRixSxZ.exe
  2⤵
  PID:4364
- C:\Windows\System\noAsSUn.exe
  C:\Windows\System\noAsSUn.exe
  2⤵
  PID:6020
- C:\Windows\System\IntulMD.exe
  C:\Windows\System\IntulMD.exe
  2⤵
  PID:6232
- C:\Windows\System\hlmJPjf.exe
  C:\Windows\System\hlmJPjf.exe
  2⤵
  PID:6456
- C:\Windows\System\bkzjnxK.exe
  C:\Windows\System\bkzjnxK.exe
  2⤵
  PID:7228
- C:\Windows\System\XYPpOuq.exe
  C:\Windows\System\XYPpOuq.exe
  2⤵
  PID:7252
- C:\Windows\System\FgVWmAS.exe
  C:\Windows\System\FgVWmAS.exe
  2⤵
  PID:6296
- C:\Windows\System\CtdXZVy.exe
  C:\Windows\System\CtdXZVy.exe
  2⤵
  PID:5712
- C:\Windows\System\GFWGmQM.exe
  C:\Windows\System\GFWGmQM.exe
  2⤵
  PID:7096
- C:\Windows\System\bizGkZb.exe
  C:\Windows\System\bizGkZb.exe
  2⤵
  PID:6344
- C:\Windows\System\EwukGBH.exe
  C:\Windows\System\EwukGBH.exe
  2⤵
  PID:4648
- C:\Windows\System\PrcrfMl.exe
  C:\Windows\System\PrcrfMl.exe
  2⤵
  PID:5556
- C:\Windows\System\HOdhKgG.exe
  C:\Windows\System\HOdhKgG.exe
  2⤵
  PID:7080
- C:\Windows\System\sAgzxBw.exe
  C:\Windows\System\sAgzxBw.exe
  2⤵
  PID:6152
- C:\Windows\System\hxNmtWf.exe
  C:\Windows\System\hxNmtWf.exe
  2⤵
  PID:7164
- C:\Windows\System\MWfczZv.exe
  C:\Windows\System\MWfczZv.exe
  2⤵
  PID:7116
- C:\Windows\System\USXCXYA.exe
  C:\Windows\System\USXCXYA.exe
  2⤵
  PID:7260
- C:\Windows\System\baeiFCY.exe
  C:\Windows\System\baeiFCY.exe
  2⤵
  PID:7320
- C:\Windows\System\ZREQwgg.exe
  C:\Windows\System\ZREQwgg.exe
  2⤵
  PID:7388
- C:\Windows\System\JYJQVpz.exe
  C:\Windows\System\JYJQVpz.exe
  2⤵
  PID:7448
- C:\Windows\System\iKuXKiU.exe
  C:\Windows\System\iKuXKiU.exe
  2⤵
  PID:7516
- C:\Windows\System\xSUclMO.exe
  C:\Windows\System\xSUclMO.exe
  2⤵
  PID:7468
- C:\Windows\System\DIHrVUD.exe
  C:\Windows\System\DIHrVUD.exe
  2⤵
  PID:7276
- C:\Windows\System\VlkQuvn.exe
  C:\Windows\System\VlkQuvn.exe
  2⤵
  PID:7340
- C:\Windows\System\odqYtYF.exe
  C:\Windows\System\odqYtYF.exe
  2⤵
  PID:7436
- C:\Windows\System\ULLGxxu.exe
  C:\Windows\System\ULLGxxu.exe
  2⤵
  PID:7548
- C:\Windows\System\MkvZqvi.exe
  C:\Windows\System\MkvZqvi.exe
  2⤵
  PID:7612
- C:\Windows\System\EPnQEWA.exe
  C:\Windows\System\EPnQEWA.exe
  2⤵
  PID:7564
- C:\Windows\System\faBIzxC.exe
  C:\Windows\System\faBIzxC.exe
  2⤵
  PID:7672
- C:\Windows\System\kLMUiOK.exe
  C:\Windows\System\kLMUiOK.exe
  2⤵
  PID:7688
- C:\Windows\System\GJlZVLX.exe
  C:\Windows\System\GJlZVLX.exe
  2⤵
  PID:7708
- C:\Windows\System\QdJzPLv.exe
  C:\Windows\System\QdJzPLv.exe
  2⤵
  PID:7740
- C:\Windows\System\wGILJlf.exe
  C:\Windows\System\wGILJlf.exe
  2⤵
  PID:7804
- C:\Windows\System\ZnUWbBD.exe
  C:\Windows\System\ZnUWbBD.exe
  2⤵
  PID:7816
- C:\Windows\System\jJaMyzN.exe
  C:\Windows\System\jJaMyzN.exe
  2⤵
  PID:7788
- C:\Windows\System\ZUarUzJ.exe
  C:\Windows\System\ZUarUzJ.exe
  2⤵
  PID:7868
- C:\Windows\System\YZePClr.exe
  C:\Windows\System\YZePClr.exe
  2⤵
  PID:7932
- C:\Windows\System\pHGmMwk.exe
  C:\Windows\System\pHGmMwk.exe
  2⤵
  PID:7996
- C:\Windows\System\giiNexN.exe
  C:\Windows\System\giiNexN.exe
  2⤵
  PID:8060
- C:\Windows\System\KLusnSp.exe
  C:\Windows\System\KLusnSp.exe
  2⤵
  PID:7912
- C:\Windows\System\FLhjCax.exe
  C:\Windows\System\FLhjCax.exe
  2⤵
  PID:7948
- C:\Windows\System\tfmBHnl.exe
  C:\Windows\System\tfmBHnl.exe
  2⤵
  PID:7980
- C:\Windows\System\xnEKJRr.exe
  C:\Windows\System\xnEKJRr.exe
  2⤵
  PID:8076
- C:\Windows\System\CxRHfqC.exe
  C:\Windows\System\CxRHfqC.exe
  2⤵
  PID:8164
- C:\Windows\System\UDRqJJk.exe
  C:\Windows\System\UDRqJJk.exe
  2⤵
  PID:7196
- C:\Windows\System\idhurKZ.exe
  C:\Windows\System\idhurKZ.exe
  2⤵
  PID:6700
- C:\Windows\System\DzYiYuG.exe
  C:\Windows\System\DzYiYuG.exe
  2⤵
  PID:6204
- C:\Windows\System\YAPkPbp.exe
  C:\Windows\System\YAPkPbp.exe
  2⤵
  PID:7008
- C:\Windows\System\BAPEkNk.exe
  C:\Windows\System\BAPEkNk.exe
  2⤵
  PID:2764
- C:\Windows\System\IVeUfjX.exe
  C:\Windows\System\IVeUfjX.exe
  2⤵
  PID:7188
- C:\Windows\System\FCTNEWw.exe
  C:\Windows\System\FCTNEWw.exe
  2⤵
  PID:6360
- C:\Windows\System\kQSttHy.exe
  C:\Windows\System\kQSttHy.exe
  2⤵
  PID:7244
- C:\Windows\System\eCRBvls.exe
  C:\Windows\System\eCRBvls.exe
  2⤵
  PID:6832
- C:\Windows\System\FtzprZr.exe
  C:\Windows\System\FtzprZr.exe
  2⤵
  PID:5972
- C:\Windows\System\puUvMVq.exe
  C:\Windows\System\puUvMVq.exe
  2⤵
  PID:7012
- C:\Windows\System\unDhjMc.exe
  C:\Windows\System\unDhjMc.exe
  2⤵
  PID:7176
- C:\Windows\System\dfZLLbN.exe
  C:\Windows\System\dfZLLbN.exe
  2⤵
  PID:5252
- C:\Windows\System\yjmjDzL.exe
  C:\Windows\System\yjmjDzL.exe
  2⤵
  PID:7288
- C:\Windows\System\ugjgznG.exe
  C:\Windows\System\ugjgznG.exe
  2⤵
  PID:7480
- C:\Windows\System\ghvDUYZ.exe
  C:\Windows\System\ghvDUYZ.exe
  2⤵
  PID:7432
- C:\Windows\System\zKJAKhb.exe
  C:\Windows\System\zKJAKhb.exe
  2⤵
  PID:7528
- C:\Windows\System\qnsYiPF.exe
  C:\Windows\System\qnsYiPF.exe
  2⤵
  PID:7308
- C:\Windows\System\sWbBdKb.exe
  C:\Windows\System\sWbBdKb.exe
  2⤵
  PID:7560
- C:\Windows\System\nOMOjEH.exe
  C:\Windows\System\nOMOjEH.exe
  2⤵
  PID:7704
- C:\Windows\System\azYxOxG.exe
  C:\Windows\System\azYxOxG.exe
  2⤵
  PID:7756
- C:\Windows\System\sPyoUTe.exe
  C:\Windows\System\sPyoUTe.exe
  2⤵
  PID:7836
- C:\Windows\System\cgpzkgt.exe
  C:\Windows\System\cgpzkgt.exe
  2⤵
  PID:8028
- C:\Windows\System\EoiNrmO.exe
  C:\Windows\System\EoiNrmO.exe
  2⤵
  PID:8012
- C:\Windows\System\iziAusg.exe
  C:\Windows\System\iziAusg.exe
  2⤵
  PID:6748
- C:\Windows\System\zRushud.exe
  C:\Windows\System\zRushud.exe
  2⤵
  PID:7852
- C:\Windows\System\QizasRu.exe
  C:\Windows\System\QizasRu.exe
  2⤵
  PID:8180
- C:\Windows\System\FgpfZOK.exe
  C:\Windows\System\FgpfZOK.exe
  2⤵
  PID:4052
- C:\Windows\System\dKcxIPI.exe
  C:\Windows\System\dKcxIPI.exe
  2⤵
  PID:6648
- C:\Windows\System\QSzVHAn.exe
  C:\Windows\System\QSzVHAn.exe
  2⤵
  PID:8072
- C:\Windows\System\wOgITKC.exe
  C:\Windows\System\wOgITKC.exe
  2⤵
  PID:7992
- C:\Windows\System\nQkFIut.exe
  C:\Windows\System\nQkFIut.exe
  2⤵
  PID:6380
- C:\Windows\System\IbtlyxF.exe
  C:\Windows\System\IbtlyxF.exe
  2⤵
  PID:7420
- C:\Windows\System\ZQIsWjP.exe
  C:\Windows\System\ZQIsWjP.exe
  2⤵
  PID:7500
- C:\Windows\System\InbKYcj.exe
  C:\Windows\System\InbKYcj.exe
  2⤵
  PID:8112
- C:\Windows\System\FoFhPqH.exe
  C:\Windows\System\FoFhPqH.exe
  2⤵
  PID:6392
- C:\Windows\System\exBLgCb.exe
  C:\Windows\System\exBLgCb.exe
  2⤵
  PID:7724
- C:\Windows\System\FHikDfA.exe
  C:\Windows\System\FHikDfA.exe
  2⤵
  PID:8152
- C:\Windows\System\qrKKvti.exe
  C:\Windows\System\qrKKvti.exe
  2⤵
  PID:6864
- C:\Windows\System\fzjkhUU.exe
  C:\Windows\System\fzjkhUU.exe
  2⤵
  PID:6936
- C:\Windows\System\TIpKDMU.exe
  C:\Windows\System\TIpKDMU.exe
  2⤵
  PID:7628
- C:\Windows\System\njJmZoe.exe
  C:\Windows\System\njJmZoe.exe
  2⤵
  PID:7372
- C:\Windows\System\lgdXVLy.exe
  C:\Windows\System\lgdXVLy.exe
  2⤵
  PID:7092
- C:\Windows\System\wwekSNj.exe
  C:\Windows\System\wwekSNj.exe
  2⤵
  PID:8088
- C:\Windows\System\QQihxKR.exe
  C:\Windows\System\QQihxKR.exe
  2⤵
  PID:7640
- C:\Windows\System\IiuHeRA.exe
  C:\Windows\System\IiuHeRA.exe
  2⤵
  PID:6828
- C:\Windows\System\ESmgmso.exe
  C:\Windows\System\ESmgmso.exe
  2⤵
  PID:6920
- C:\Windows\System\BYAoycg.exe
  C:\Windows\System\BYAoycg.exe
  2⤵
  PID:7944
- C:\Windows\System\BzGgdKM.exe
  C:\Windows\System\BzGgdKM.exe
  2⤵
  PID:6428
- C:\Windows\System\vXPssqH.exe
  C:\Windows\System\vXPssqH.exe
  2⤵
  PID:8200
- C:\Windows\System\freEhlc.exe
  C:\Windows\System\freEhlc.exe
  2⤵
  PID:8216
- C:\Windows\System\iTOrpcV.exe
  C:\Windows\System\iTOrpcV.exe
  2⤵
  PID:8232
- C:\Windows\System\AtbLLvi.exe
  C:\Windows\System\AtbLLvi.exe
  2⤵
  PID:8248
- C:\Windows\System\YUMfAXp.exe
  C:\Windows\System\YUMfAXp.exe
  2⤵
  PID:8264
- C:\Windows\System\AqSozLN.exe
  C:\Windows\System\AqSozLN.exe
  2⤵
  PID:8280
- C:\Windows\System\batoTOm.exe
  C:\Windows\System\batoTOm.exe
  2⤵
  PID:8296
- C:\Windows\System\qolqSIj.exe
  C:\Windows\System\qolqSIj.exe
  2⤵
  PID:8312
- C:\Windows\System\GBfAFiq.exe
  C:\Windows\System\GBfAFiq.exe
  2⤵
  PID:8328
- C:\Windows\System\UJxkFoL.exe
  C:\Windows\System\UJxkFoL.exe
  2⤵
  PID:8344
- C:\Windows\System\NqTvUoT.exe
  C:\Windows\System\NqTvUoT.exe
  2⤵
  PID:8360
- C:\Windows\System\smTjDFR.exe
  C:\Windows\System\smTjDFR.exe
  2⤵
  PID:8376
- C:\Windows\System\lLKWnQj.exe
  C:\Windows\System\lLKWnQj.exe
  2⤵
  PID:8392
- C:\Windows\System\sPxbBcR.exe
  C:\Windows\System\sPxbBcR.exe
  2⤵
  PID:8408
- C:\Windows\System\PkyIKiQ.exe
  C:\Windows\System\PkyIKiQ.exe
  2⤵
  PID:8424
- C:\Windows\System\kOxyMYn.exe
  C:\Windows\System\kOxyMYn.exe
  2⤵
  PID:8440
- C:\Windows\System\NnZkEBR.exe
  C:\Windows\System\NnZkEBR.exe
  2⤵
  PID:8456
- C:\Windows\System\pwuyvLy.exe
  C:\Windows\System\pwuyvLy.exe
  2⤵
  PID:8472
- C:\Windows\System\foTuWzZ.exe
  C:\Windows\System\foTuWzZ.exe
  2⤵
  PID:8488
- C:\Windows\System\gBHYcdx.exe
  C:\Windows\System\gBHYcdx.exe
  2⤵
  PID:8504
- C:\Windows\System\hAFudHO.exe
  C:\Windows\System\hAFudHO.exe
  2⤵
  PID:8520
- C:\Windows\System\fMRFJoj.exe
  C:\Windows\System\fMRFJoj.exe
  2⤵
  PID:8536
- C:\Windows\System\ZujCKiD.exe
  C:\Windows\System\ZujCKiD.exe
  2⤵
  PID:8556
- C:\Windows\System\InteVjy.exe
  C:\Windows\System\InteVjy.exe
  2⤵
  PID:8572
- C:\Windows\System\MCqGALO.exe
  C:\Windows\System\MCqGALO.exe
  2⤵
  PID:8588
- C:\Windows\System\ISwjaen.exe
  C:\Windows\System\ISwjaen.exe
  2⤵
  PID:8604
- C:\Windows\System\maFTjDZ.exe
  C:\Windows\System\maFTjDZ.exe
  2⤵
  PID:8620
- C:\Windows\System\gZEFogx.exe
  C:\Windows\System\gZEFogx.exe
  2⤵
  PID:8636
- C:\Windows\System\qWqeoff.exe
  C:\Windows\System\qWqeoff.exe
  2⤵
  PID:8652
- C:\Windows\System\tMMnNPn.exe
  C:\Windows\System\tMMnNPn.exe
  2⤵
  PID:8668
- C:\Windows\System\TCWHzrL.exe
  C:\Windows\System\TCWHzrL.exe
  2⤵
  PID:8684
- C:\Windows\System\XpxsrZx.exe
  C:\Windows\System\XpxsrZx.exe
  2⤵
  PID:8700
- C:\Windows\System\wCOOsuP.exe
  C:\Windows\System\wCOOsuP.exe
  2⤵
  PID:8716
- C:\Windows\System\UXXNZUZ.exe
  C:\Windows\System\UXXNZUZ.exe
  2⤵
  PID:8732
- C:\Windows\System\rasqhod.exe
  C:\Windows\System\rasqhod.exe
  2⤵
  PID:8748
- C:\Windows\System\HfdINlP.exe
  C:\Windows\System\HfdINlP.exe
  2⤵
  PID:8764
- C:\Windows\System\ZWchofg.exe
  C:\Windows\System\ZWchofg.exe
  2⤵
  PID:8780
- C:\Windows\System\ltKOmJh.exe
  C:\Windows\System\ltKOmJh.exe
  2⤵
  PID:8796
- C:\Windows\System\WYwQiwf.exe
  C:\Windows\System\WYwQiwf.exe
  2⤵
  PID:8812
- C:\Windows\System\pCzpPnK.exe
  C:\Windows\System\pCzpPnK.exe
  2⤵
  PID:8828
- C:\Windows\System\lwlqBJS.exe
  C:\Windows\System\lwlqBJS.exe
  2⤵
  PID:8848
- C:\Windows\System\BmUgieI.exe
  C:\Windows\System\BmUgieI.exe
  2⤵
  PID:8864
- C:\Windows\System\DxfPnJk.exe
  C:\Windows\System\DxfPnJk.exe
  2⤵
  PID:8880
- C:\Windows\System\agSeJRd.exe
  C:\Windows\System\agSeJRd.exe
  2⤵
  PID:8896
- C:\Windows\System\Aykcoub.exe
  C:\Windows\System\Aykcoub.exe
  2⤵
  PID:8912
- C:\Windows\System\wUQpmsg.exe
  C:\Windows\System\wUQpmsg.exe
  2⤵
  PID:8928
- C:\Windows\System\OnfaeSB.exe
  C:\Windows\System\OnfaeSB.exe
  2⤵
  PID:8944
- C:\Windows\System\SUTyjHa.exe
  C:\Windows\System\SUTyjHa.exe
  2⤵
  PID:8960
- C:\Windows\System\DOQHLKM.exe
  C:\Windows\System\DOQHLKM.exe
  2⤵
  PID:8976
- C:\Windows\System\lXBbfRE.exe
  C:\Windows\System\lXBbfRE.exe
  2⤵
  PID:8992
- C:\Windows\System\zJrXNBu.exe
  C:\Windows\System\zJrXNBu.exe
  2⤵
  PID:9008
- C:\Windows\System\LvVTqnz.exe
  C:\Windows\System\LvVTqnz.exe
  2⤵
  PID:9024
- C:\Windows\System\IsHeoaD.exe
  C:\Windows\System\IsHeoaD.exe
  2⤵
  PID:9040
- C:\Windows\System\gxsoVzq.exe
  C:\Windows\System\gxsoVzq.exe
  2⤵
  PID:9064
- C:\Windows\System\coJeKXm.exe
  C:\Windows\System\coJeKXm.exe
  2⤵
  PID:9080
- C:\Windows\System\JClxpjL.exe
  C:\Windows\System\JClxpjL.exe
  2⤵
  PID:9096
- C:\Windows\System\HRluUPX.exe
  C:\Windows\System\HRluUPX.exe
  2⤵
  PID:9112
- C:\Windows\System\qpKekel.exe
  C:\Windows\System\qpKekel.exe
  2⤵
  PID:9132
- C:\Windows\System\wbRpASF.exe
  C:\Windows\System\wbRpASF.exe
  2⤵
  PID:9148
- C:\Windows\System\qFojOrV.exe
  C:\Windows\System\qFojOrV.exe
  2⤵
  PID:9164
- C:\Windows\System\wZmBpdJ.exe
  C:\Windows\System\wZmBpdJ.exe
  2⤵
  PID:9180
- C:\Windows\System\EwRcLCk.exe
  C:\Windows\System\EwRcLCk.exe
  2⤵
  PID:9212
- C:\Windows\System\BixAPVV.exe
  C:\Windows\System\BixAPVV.exe
  2⤵
  PID:7256
- C:\Windows\System\KIkUJVx.exe
  C:\Windows\System\KIkUJVx.exe
  2⤵
  PID:7720
- C:\Windows\System\opVDiZF.exe
  C:\Windows\System\opVDiZF.exe
  2⤵
  PID:6684
- C:\Windows\System\bLuKRju.exe
  C:\Windows\System\bLuKRju.exe
  2⤵
  PID:8256
- C:\Windows\System\XYRYKTf.exe
  C:\Windows\System\XYRYKTf.exe
  2⤵
  PID:8340
- C:\Windows\System\SZKhxwG.exe
  C:\Windows\System\SZKhxwG.exe
  2⤵
  PID:8372
- C:\Windows\System\vFCQIaz.exe
  C:\Windows\System\vFCQIaz.exe
  2⤵
  PID:8432
- C:\Windows\System\gfAAeeb.exe
  C:\Windows\System\gfAAeeb.exe
  2⤵
  PID:8420
- C:\Windows\System\MVLkngT.exe
  C:\Windows\System\MVLkngT.exe
  2⤵
  PID:8468
- C:\Windows\System\dCieUBq.exe
  C:\Windows\System\dCieUBq.exe
  2⤵
  PID:8500
- C:\Windows\System\llctrsN.exe
  C:\Windows\System\llctrsN.exe
  2⤵
  PID:8516
- C:\Windows\System\KpMSFvj.exe
  C:\Windows\System\KpMSFvj.exe
  2⤵
  PID:8568
- C:\Windows\System\PntRzwL.exe
  C:\Windows\System\PntRzwL.exe
  2⤵
  PID:8632
- C:\Windows\System\cHlpVvb.exe
  C:\Windows\System\cHlpVvb.exe
  2⤵
  PID:8692
- C:\Windows\System\yfTgeWA.exe
  C:\Windows\System\yfTgeWA.exe
  2⤵
  PID:8612
- C:\Windows\System\SGPcGdr.exe
  C:\Windows\System\SGPcGdr.exe
  2⤵
  PID:8756
- C:\Windows\System\WXKcuwA.exe
  C:\Windows\System\WXKcuwA.exe
  2⤵
  PID:8820
- C:\Windows\System\IBRwsBY.exe
  C:\Windows\System\IBRwsBY.exe
  2⤵
  PID:8616
- C:\Windows\System\vXYNpjS.exe
  C:\Windows\System\vXYNpjS.exe
  2⤵
  PID:8804
- C:\Windows\System\heTtOEs.exe
  C:\Windows\System\heTtOEs.exe
  2⤵
  PID:8740
- C:\Windows\System\zApAQJn.exe
  C:\Windows\System\zApAQJn.exe
  2⤵
  PID:8844
- C:\Windows\System\GvpzvMD.exe
  C:\Windows\System\GvpzvMD.exe
  2⤵
  PID:8892
- C:\Windows\System\GqQMJwt.exe
  C:\Windows\System\GqQMJwt.exe
  2⤵
  PID:8956
- C:\Windows\System\UOAiPPF.exe
  C:\Windows\System\UOAiPPF.exe
  2⤵
  PID:9020
- C:\Windows\System\QuolnFq.exe
  C:\Windows\System\QuolnFq.exe
  2⤵
  PID:8548
- C:\Windows\System\GtNsYXS.exe
  C:\Windows\System\GtNsYXS.exe
  2⤵
  PID:8940
- C:\Windows\System\UxsRxsq.exe
  C:\Windows\System\UxsRxsq.exe
  2⤵
  PID:9032
- C:\Windows\System\CMHhMLt.exe
  C:\Windows\System\CMHhMLt.exe
  2⤵
  PID:9060
- C:\Windows\System\lYlyiwx.exe
  C:\Windows\System\lYlyiwx.exe
  2⤵
  PID:9128
- C:\Windows\System\hEqxwxi.exe
  C:\Windows\System\hEqxwxi.exe
  2⤵
  PID:9104
- C:\Windows\System\OMeOgEG.exe
  C:\Windows\System\OMeOgEG.exe
  2⤵
  PID:9172
- C:\Windows\System\rvubaZr.exe
  C:\Windows\System\rvubaZr.exe
  2⤵
  PID:9196
- C:\Windows\System\AdZqvNr.exe
  C:\Windows\System\AdZqvNr.exe
  2⤵
  PID:9200
- C:\Windows\System\TElEWWB.exe
  C:\Windows\System\TElEWWB.exe
  2⤵
  PID:8228
- C:\Windows\System\MmMSOtl.exe
  C:\Windows\System\MmMSOtl.exe
  2⤵
  PID:7532
- C:\Windows\System\LKXEFiI.exe
  C:\Windows\System\LKXEFiI.exe
  2⤵
  PID:8304
- C:\Windows\System\ORFABCr.exe
  C:\Windows\System\ORFABCr.exe
  2⤵
  PID:8452
- C:\Windows\System\qExelMe.exe
  C:\Windows\System\qExelMe.exe
  2⤵
  PID:8836
- C:\Windows\System\KNsTrdS.exe
  C:\Windows\System\KNsTrdS.exe
  2⤵
  PID:8876
- C:\Windows\System\CGNMeUh.exe
  C:\Windows\System\CGNMeUh.exe
  2⤵
  PID:8404
- C:\Windows\System\azRpqqt.exe
  C:\Windows\System\azRpqqt.exe
  2⤵
  PID:9120
- C:\Windows\System\vYAjapS.exe
  C:\Windows\System\vYAjapS.exe
  2⤵
  PID:8128
- C:\Windows\System\tRnqUNs.exe
  C:\Windows\System\tRnqUNs.exe
  2⤵
  PID:8712
- C:\Windows\System\EXFVIrm.exe
  C:\Windows\System\EXFVIrm.exe
  2⤵
  PID:8676
- C:\Windows\System\ivyQYBq.exe
  C:\Windows\System\ivyQYBq.exe
  2⤵
  PID:8776
- C:\Windows\System\CQLuePY.exe
  C:\Windows\System\CQLuePY.exe
  2⤵
  PID:8952
- C:\Windows\System\BhZAQlF.exe
  C:\Windows\System\BhZAQlF.exe
  2⤵
  PID:9140
- C:\Windows\System\lxEqDYR.exe
  C:\Windows\System\lxEqDYR.exe
  2⤵
  PID:8092
- C:\Windows\System\WwxBrDr.exe
  C:\Windows\System\WwxBrDr.exe
  2⤵
  PID:8308
- C:\Windows\System\IUmUvbc.exe
  C:\Windows\System\IUmUvbc.exe
  2⤵
  PID:7352
- C:\Windows\System\IheVkYp.exe
  C:\Windows\System\IheVkYp.exe
  2⤵
  PID:8324
- C:\Windows\System\EsaYmCO.exe
  C:\Windows\System\EsaYmCO.exe
  2⤵
  PID:8196
- C:\Windows\System\ATTNNWM.exe
  C:\Windows\System\ATTNNWM.exe
  2⤵
  PID:8416
- C:\Windows\System\lFKlYQz.exe
  C:\Windows\System\lFKlYQz.exe
  2⤵
  PID:8484
- C:\Windows\System\rIRdbiJ.exe
  C:\Windows\System\rIRdbiJ.exe
  2⤵
  PID:8648
- C:\Windows\System\FfknMAu.exe
  C:\Windows\System\FfknMAu.exe
  2⤵
  PID:8860
- C:\Windows\System\GnNjTCu.exe
  C:\Windows\System\GnNjTCu.exe
  2⤵
  PID:9160
- C:\Windows\System\iPBNGYR.exe
  C:\Windows\System\iPBNGYR.exe
  2⤵
  PID:8772
- C:\Windows\System\RhJMDad.exe
  C:\Windows\System\RhJMDad.exe
  2⤵
  PID:8908
- C:\Windows\System\wgeAQde.exe
  C:\Windows\System\wgeAQde.exe
  2⤵
  PID:8384
- C:\Windows\System\TVJWTUP.exe
  C:\Windows\System\TVJWTUP.exe
  2⤵
  PID:9000
- C:\Windows\System\CTGhKor.exe
  C:\Windows\System\CTGhKor.exe
  2⤵
  PID:9088
- C:\Windows\System\rDrneEp.exe
  C:\Windows\System\rDrneEp.exe
  2⤵
  PID:8564
- C:\Windows\System\VFCQKag.exe
  C:\Windows\System\VFCQKag.exe
  2⤵
  PID:8988
- C:\Windows\System\HehyVlj.exe
  C:\Windows\System\HehyVlj.exe
  2⤵
  PID:8148
- C:\Windows\System\MxoZnRd.exe
  C:\Windows\System\MxoZnRd.exe
  2⤵
  PID:9056
- C:\Windows\System\AlnFQQo.exe
  C:\Windows\System\AlnFQQo.exe
  2⤵
  PID:8936
- C:\Windows\System\xlauJNV.exe
  C:\Windows\System\xlauJNV.exe
  2⤵
  PID:9232
- C:\Windows\System\IRBJdME.exe
  C:\Windows\System\IRBJdME.exe
  2⤵
  PID:9252
- C:\Windows\System\aHIeexD.exe
  C:\Windows\System\aHIeexD.exe
  2⤵
  PID:9268
- C:\Windows\System\udwCRTU.exe
  C:\Windows\System\udwCRTU.exe
  2⤵
  PID:9284
- C:\Windows\System\NHLevNU.exe
  C:\Windows\System\NHLevNU.exe
  2⤵
  PID:9300
- C:\Windows\System\fmMfDil.exe
  C:\Windows\System\fmMfDil.exe
  2⤵
  PID:9316
- C:\Windows\System\sMRiMTY.exe
  C:\Windows\System\sMRiMTY.exe
  2⤵
  PID:9332
- C:\Windows\System\OGHcIVi.exe
  C:\Windows\System\OGHcIVi.exe
  2⤵
  PID:9352
- C:\Windows\System\uLqmJCc.exe
  C:\Windows\System\uLqmJCc.exe
  2⤵
  PID:9368
- C:\Windows\System\yBFFddW.exe
  C:\Windows\System\yBFFddW.exe
  2⤵
  PID:9384
- C:\Windows\System\PaVeeBq.exe
  C:\Windows\System\PaVeeBq.exe
  2⤵
  PID:9404
- C:\Windows\System\feqmqSU.exe
  C:\Windows\System\feqmqSU.exe
  2⤵
  PID:9420
- C:\Windows\System\oKqFGkv.exe
  C:\Windows\System\oKqFGkv.exe
  2⤵
  PID:9436
- C:\Windows\System\QwKSuvw.exe
  C:\Windows\System\QwKSuvw.exe
  2⤵
  PID:9456
- C:\Windows\System\oLXKDgd.exe
  C:\Windows\System\oLXKDgd.exe
  2⤵
  PID:9472
- C:\Windows\System\Ttuozgh.exe
  C:\Windows\System\Ttuozgh.exe
  2⤵
  PID:9488
- C:\Windows\System\XHIblxC.exe
  C:\Windows\System\XHIblxC.exe
  2⤵
  PID:9504
- C:\Windows\System\GvPmfIt.exe
  C:\Windows\System\GvPmfIt.exe
  2⤵
  PID:9520
- C:\Windows\System\CinpnXT.exe
  C:\Windows\System\CinpnXT.exe
  2⤵
  PID:9536
- C:\Windows\System\fZxzjre.exe
  C:\Windows\System\fZxzjre.exe
  2⤵
  PID:9552
- C:\Windows\System\SbgjrUa.exe
  C:\Windows\System\SbgjrUa.exe
  2⤵
  PID:9568
- C:\Windows\System\SLwXonq.exe
  C:\Windows\System\SLwXonq.exe
  2⤵
  PID:9584
- C:\Windows\System\LGmKqBW.exe
  C:\Windows\System\LGmKqBW.exe
  2⤵
  PID:9600
- C:\Windows\System\PWVPbdC.exe
  C:\Windows\System\PWVPbdC.exe
  2⤵
  PID:9616
- C:\Windows\System\JcNaakJ.exe
  C:\Windows\System\JcNaakJ.exe
  2⤵
  PID:9632
- C:\Windows\System\RKpVjvE.exe
  C:\Windows\System\RKpVjvE.exe
  2⤵
  PID:9648
- C:\Windows\System\wBHfRGY.exe
  C:\Windows\System\wBHfRGY.exe
  2⤵
  PID:9664
- C:\Windows\System\pqsPWgD.exe
  C:\Windows\System\pqsPWgD.exe
  2⤵
  PID:9680
- C:\Windows\System\JOJgEQj.exe
  C:\Windows\System\JOJgEQj.exe
  2⤵
  PID:9696
- C:\Windows\System\qGObrwP.exe
  C:\Windows\System\qGObrwP.exe
  2⤵
  PID:9712
- C:\Windows\System\TSrdTJQ.exe
  C:\Windows\System\TSrdTJQ.exe
  2⤵
  PID:9728
- C:\Windows\System\rYphQox.exe
  C:\Windows\System\rYphQox.exe
  2⤵
  PID:9744
- C:\Windows\System\QrymVAH.exe
  C:\Windows\System\QrymVAH.exe
  2⤵
  PID:9760
- C:\Windows\System\qEgJver.exe
  C:\Windows\System\qEgJver.exe
  2⤵
  PID:9776
- C:\Windows\System\cTNulHV.exe
  C:\Windows\System\cTNulHV.exe
  2⤵
  PID:9792
- C:\Windows\System\DjVBblG.exe
  C:\Windows\System\DjVBblG.exe
  2⤵
  PID:9808
- C:\Windows\System\iqcwENE.exe
  C:\Windows\System\iqcwENE.exe
  2⤵
  PID:9824
- C:\Windows\System\kiGlenA.exe
  C:\Windows\System\kiGlenA.exe
  2⤵
  PID:9904
- C:\Windows\System\aqrtHMe.exe
  C:\Windows\System\aqrtHMe.exe
  2⤵
  PID:9928
- C:\Windows\System\orMcoff.exe
  C:\Windows\System\orMcoff.exe
  2⤵
  PID:9948
- C:\Windows\System\pCphCLS.exe
  C:\Windows\System\pCphCLS.exe
  2⤵
  PID:9964
- C:\Windows\System\wIOmyfj.exe
  C:\Windows\System\wIOmyfj.exe
  2⤵
  PID:9980
- C:\Windows\System\EpPocxz.exe
  C:\Windows\System\EpPocxz.exe
  2⤵
  PID:10000
- C:\Windows\System\qkopxxX.exe
  C:\Windows\System\qkopxxX.exe
  2⤵
  PID:10016
- C:\Windows\System\dyWseRN.exe
  C:\Windows\System\dyWseRN.exe
  2⤵
  PID:10032
- C:\Windows\System\UeiLJLa.exe
  C:\Windows\System\UeiLJLa.exe
  2⤵
  PID:10052
- C:\Windows\System\mQyewAI.exe
  C:\Windows\System\mQyewAI.exe
  2⤵
  PID:10068
- C:\Windows\System\LNouJRw.exe
  C:\Windows\System\LNouJRw.exe
  2⤵
  PID:10084
- C:\Windows\System\KfFriiF.exe
  C:\Windows\System\KfFriiF.exe
  2⤵
  PID:10100
- C:\Windows\System\OokUIUd.exe
  C:\Windows\System\OokUIUd.exe
  2⤵
  PID:10116
- C:\Windows\System\WaFWStV.exe
  C:\Windows\System\WaFWStV.exe
  2⤵
  PID:10132
- C:\Windows\System\aMsgIku.exe
  C:\Windows\System\aMsgIku.exe
  2⤵
  PID:10148
- C:\Windows\System\XsFzhad.exe
  C:\Windows\System\XsFzhad.exe
  2⤵
  PID:10164
- C:\Windows\System\bngaARe.exe
  C:\Windows\System\bngaARe.exe
  2⤵
  PID:10180
- C:\Windows\System\UAXigeu.exe
  C:\Windows\System\UAXigeu.exe
  2⤵
  PID:10196
- C:\Windows\System\tPMmvNR.exe
  C:\Windows\System\tPMmvNR.exe
  2⤵
  PID:10212
- C:\Windows\System\lYqgNrA.exe
  C:\Windows\System\lYqgNrA.exe
  2⤵
  PID:10228
- C:\Windows\System\nvScpng.exe
  C:\Windows\System\nvScpng.exe
  2⤵
  PID:9228
- C:\Windows\System\QDvBPcy.exe
  C:\Windows\System\QDvBPcy.exe
  2⤵
  PID:9380
- C:\Windows\System\PVFyZMt.exe
  C:\Windows\System\PVFyZMt.exe
  2⤵
  PID:9444
- C:\Windows\System\VmgFkwP.exe
  C:\Windows\System\VmgFkwP.exe
  2⤵
  PID:9392
- C:\Windows\System\vUQuzxy.exe
  C:\Windows\System\vUQuzxy.exe
  2⤵
  PID:9432
- C:\Windows\System\HBIyXHg.exe
  C:\Windows\System\HBIyXHg.exe
  2⤵
  PID:9500
- C:\Windows\System\BmHeaiw.exe
  C:\Windows\System\BmHeaiw.exe
  2⤵
  PID:9592
- C:\Windows\System\EoAkaiy.exe
  C:\Windows\System\EoAkaiy.exe
  2⤵
  PID:9628
- C:\Windows\System\CGSoePQ.exe
  C:\Windows\System\CGSoePQ.exe
  2⤵
  PID:9688
- C:\Windows\System\cHxRUmR.exe
  C:\Windows\System\cHxRUmR.exe
  2⤵
  PID:9484
- C:\Windows\System\hhsxBZc.exe
  C:\Windows\System\hhsxBZc.exe
  2⤵
  PID:9512
- C:\Windows\System\GfojarJ.exe
  C:\Windows\System\GfojarJ.exe
  2⤵
  PID:9576
- C:\Windows\System\AcAQDzR.exe
  C:\Windows\System\AcAQDzR.exe
  2⤵
  PID:9640
- C:\Windows\System\DioOmTB.exe
  C:\Windows\System\DioOmTB.exe
  2⤵
  PID:9752
- C:\Windows\System\GppqaZr.exe
  C:\Windows\System\GppqaZr.exe
  2⤵
  PID:9816
- C:\Windows\System\xTEllYX.exe
  C:\Windows\System\xTEllYX.exe
  2⤵
  PID:9832
- C:\Windows\System\RelFMsN.exe
  C:\Windows\System\RelFMsN.exe
  2⤵
  PID:8320
- C:\Windows\System\sCBGsWy.exe
  C:\Windows\System\sCBGsWy.exe
  2⤵
  PID:9864
- C:\Windows\System\sYJtlnj.exe
  C:\Windows\System\sYJtlnj.exe
  2⤵
  PID:9880
- C:\Windows\System\zMCzIMr.exe
  C:\Windows\System\zMCzIMr.exe
  2⤵
  PID:9848
- C:\Windows\System\jXZgmdu.exe
  C:\Windows\System\jXZgmdu.exe
  2⤵
  PID:9920
- C:\Windows\System\ERBYQEZ.exe
  C:\Windows\System\ERBYQEZ.exe
  2⤵
  PID:10160
- C:\Windows\System\JJHigGQ.exe
  C:\Windows\System\JJHigGQ.exe
  2⤵
  PID:10012
- C:\Windows\System\bozXRRG.exe
  C:\Windows\System\bozXRRG.exe
  2⤵
  PID:10224
- C:\Windows\System\qhiioVm.exe
  C:\Windows\System\qhiioVm.exe
  2⤵
  PID:10144
- C:\Windows\System\PwgpbKn.exe
  C:\Windows\System\PwgpbKn.exe
  2⤵
  PID:10172
- C:\Windows\System\BDbnTYX.exe
  C:\Windows\System\BDbnTYX.exe
  2⤵
  PID:9840
- C:\Windows\System\UgWlCzi.exe
  C:\Windows\System\UgWlCzi.exe
  2⤵
  PID:8724
- C:\Windows\System\tuKQBmr.exe
  C:\Windows\System\tuKQBmr.exe
  2⤵
  PID:8356
- C:\Windows\System\pyBxOEV.exe
  C:\Windows\System\pyBxOEV.exe
  2⤵
  PID:9324
- C:\Windows\System\IcdIIGA.exe
  C:\Windows\System\IcdIIGA.exe
  2⤵
  PID:9360
- C:\Windows\System\bZKFUIJ.exe
  C:\Windows\System\bZKFUIJ.exe
  2⤵
  PID:9560
- C:\Windows\System\honaewC.exe
  C:\Windows\System\honaewC.exe
  2⤵
  PID:9624
- C:\Windows\System\xcsIVfo.exe
  C:\Windows\System\xcsIVfo.exe
  2⤵
  PID:9612
- C:\Windows\System\drHwXwA.exe
  C:\Windows\System\drHwXwA.exe
  2⤵
  PID:9708
- C:\Windows\System\QVyZhYJ.exe
  C:\Windows\System\QVyZhYJ.exe
  2⤵
  PID:9888
- C:\Windows\System\IErfuxl.exe
  C:\Windows\System\IErfuxl.exe
  2⤵
  PID:9564
- C:\Windows\System\jgSzOKT.exe
  C:\Windows\System\jgSzOKT.exe
  2⤵
  PID:9580
- C:\Windows\System\DUFnrCW.exe
  C:\Windows\System\DUFnrCW.exe
  2⤵
  PID:9844
- C:\Windows\System\GpUmCtI.exe
  C:\Windows\System\GpUmCtI.exe
  2⤵
  PID:9924
- C:\Windows\System\RXIcvnn.exe
  C:\Windows\System\RXIcvnn.exe
  2⤵
  PID:9836
- C:\Windows\System\fsHJRau.exe
  C:\Windows\System\fsHJRau.exe
  2⤵
  PID:9896
- C:\Windows\System\kJEwGCS.exe
  C:\Windows\System\kJEwGCS.exe
  2⤵
  PID:10092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DWpguRG.exe

Filesize
1.9MB

MD5
7bb34b927a1457c51a752f0fcc4015d6

SHA1
aa93628db5d71713b0da34732969e1937bf9beaa

SHA256
9c21ef54f5aff4d1bd5872786ffa4ed32b05aa2cd98fb2137d2f9a45d98bdea7

SHA512
85db6011de61e3fff98d941544f76513c5d346305fe1dc8e8e6ff499b63c7084806d32409f2103fb411394f1401069c44e1f91dee61debef1e04b508b4566f65

Download Submit
C:\Windows\system\EzWoGLg.exe

Filesize
1.9MB

MD5
73f0e79fd6652ce4cf3c7878e4af23af

SHA1
500f91feb9d137877fad360c1bdefcf6193c56d1

SHA256
e9101361c44c62c791211b4cad0970c04cdb97f190a2ac432dc02eb303104f52

SHA512
a53bfe906f16725b2f3277e3387a044ad26a8e434f3f9d888093292659186a6fc4fa42795d5e408d96884d8ea2afbed429fd5eb83060a30a6ef4ccc33c222e43

Download Submit
C:\Windows\system\ISPmqxt.exe

Filesize
1.9MB

MD5
bf29b9f95034b41abd45740cc606a7e6

SHA1
097a837ade5f8114502d231c1fde0e1974bf89b9

SHA256
7ace4b4efaed48a852406326882d602b796062fa61abda401a145d80c9d867df

SHA512
c0f4b7047fd165f82d1632b7355196543397cc273fa4e00156531edc90653daf788da2a8400d1d4c8dbe49809b976ed04061cb19ec3319624f5949c85d522ce9

Download Submit
C:\Windows\system\MgBePWb.exe

Filesize
1.9MB

MD5
080dad325794897ca2e55dac0a3008b0

SHA1
7979a7559666dd594debbd25471f1feb023aa741

SHA256
54bbf6af48a8b07b040847c127fa8b02ce4287b76ab4cab68d72e09f78053ef2

SHA512
921e7bdb1e4232dff976ca9e31e7971be4f6f0a95781e7d3bbe23add649927eea3ef84fd640e032c73347a77706b5e303644eb09ebd146271da427695cde409c

Download Submit
C:\Windows\system\SGeRYDi.exe

Filesize
1.9MB

MD5
7c964dfe0b88abecc2d84fc87507928c

SHA1
31b0af1ae1765563339b14d391b28adcf6d6c1fd

SHA256
04a7ebd94cc87481b1a3b4113cb3e0e54ff82473ea7d3e271154a47908d8df93

SHA512
08f0b23a0975411b1f70f2a3b6868c712db0d1a1c42de977140f719180e9307112039ec12fcead1d4472a7f9c2df67542683756fcb51eb31a6042f05eb5bde2e

Download Submit
C:\Windows\system\WGwvzrr.exe

Filesize
1.9MB

MD5
5594e6cee9cf25c3fcc705ecd799715b

SHA1
976964e193f5c28b70e30e9f095078c1468f59a9

SHA256
8a08296de870b3603b44d9f739fbbab4123bbf6cac8e85e518a4294a7e3e753d

SHA512
8c578c6709835628e1108710037ab50ffc467380faefa91b576cdaa4e0e2d39a92905943502c3cc511c59f1d7f30a8c73f8761f281a87090525a118136924bcb

Download Submit
C:\Windows\system\docrvta.exe

Filesize
1.9MB

MD5
9424922ccc99f4bbc81312afc2d98818

SHA1
f0ab1a9bcff42346aadaaac68e555b8d372fc5f6

SHA256
a7278586ebb5f4d4445a113e63a1a60fc38d2f4aee909e53730b8bd8302ef94c

SHA512
e1a9dad0ee84f42fa676dd975998d1b0a8b75008286bfd06360ee18317e197f4206e8cf477c8017963b60c1ef3c0b9cd0af24b20d88e86f5be7e0eb308fbc168

Download Submit
C:\Windows\system\etieeVb.exe

Filesize
1.9MB

MD5
a6477f7ffe9c14442cf1ad961e2a6c6c

SHA1
9f3ed2fb8dbc8f88655027da19144bc0dc1bdad8

SHA256
9495572272f84b402178149c1f4de6c38ece49758e557f6daaed64296498f29f

SHA512
fddfddb59da2c52f90cb61516cd7bc449bbbd8e09e2a65e7a9324988397485f887275a8531e0083448dee4197d51590dc7667f4c6be457bc25d534d1f7dda929

Download Submit
C:\Windows\system\gChupWw.exe

Filesize
1.9MB

MD5
eae755eae60eb6ed52c1b8cb6b0550ce

SHA1
da18ad885a89bec6ab477a7ffdc96ff375de58f3

SHA256
f192914e0f5cca5734baff764fb7e282e34324e2f4a13c796d264d5ba505df9d

SHA512
8564c0b915059d4150151c30a0a5a6b2f5a1fd23b8675c92da0b2c5ba4e2b69c805c2fec99030b385248ed34f12d879cc9ac2ba0119ebb65b6223faf39d13df6

Download Submit
C:\Windows\system\gPpidKY.exe

Filesize
1.9MB

MD5
4f953f5ee6ef933beeea72dde61f3a30

SHA1
a1d96efd929a7780431706fd6f4f6eb237d2ee70

SHA256
755d4e0a006d549a560b0aef26c89db9183d985997b5e8cbfa9a4c0194da277c

SHA512
71b80126e44598658f35afed1c5369527c1229b2049b4947a09a94ea92f577ccf6a67f43ac5a16ff16db119f4c6e6cdb5c4696b4a42624e1d663045cd908ee04

Download Submit
C:\Windows\system\ixygULo.exe

Filesize
1.9MB

MD5
0aaed972c9512b830ee2a4282b1b2320

SHA1
a4ba3c6048220d9d259cb35eb74dbf5bf5bd4de0

SHA256
f10b12903f41a39743000dce606356c604d48ac9a76a43968fd1357ef9127cef

SHA512
b9a533efe1c006fa283b4c7fd1b453ddb0f315a9a1ef215d251128c4f1ba1a838abcd7e68df5337106e5d7c30f6c495747ba78c4ae74559fc4a789f2c83d0d2f

Download Submit
C:\Windows\system\mHNyGjL.exe

Filesize
1.9MB

MD5
24ad5b1087130f971633f11a2855d6ab

SHA1
bc9882f1437f7bf3c0c1cce967a6815542cb9f80

SHA256
dd68e46681bf40883796d8df0ab799e5e1a5d661fb679c5414ddc85e5ff3bde4

SHA512
dbd3aae0a116de75d61592194422fa34bf6937c7122567656b93376b32046411fda17233d36bef37dc2477378f1cd88ac84b00d310a036ea8f24b7aad9a23058

Download Submit
C:\Windows\system\qTWhCNZ.exe

Filesize
1.9MB

MD5
65f9b85844db071366da9b4da51cdfba

SHA1
203f86860e831f1252cc101c16f07e3dc601c59a

SHA256
5424c18858739f5ff78c81cb1609fb070a74fec2e8c85634ce88a04248d44721

SHA512
c72158cca6a59adb5bab1961425c866e6b70fa0bead2dca61855de01c06efa62163f4972c1a74d1f8a475a81d3c10d706a5e5416c492bc2a6cdca28814acff48

Download Submit
C:\Windows\system\qlsmsNg.exe

Filesize
1.9MB

MD5
0f09aa938d1120e0c85d8bb0748888b7

SHA1
dfa9ea299f95991af931b3a2bc004991ca68236f

SHA256
ae3f524d590f8b7bb7ae2b0d111cc4d2c4ec493346683eb0d980630713cc33ae

SHA512
5def2d72d2a6f72d8290144340b01fb8519c3cf70b623d1766ca603c96d948ec08fabaa6216a598be88eb5fd2c293ee9dae062d649aaf000f47d80568c06dab0

Download Submit
C:\Windows\system\tdGVYLO.exe

Filesize
1.9MB

MD5
107fe37420a4e78d6a4f9401d9d95408

SHA1
d8a5819cd8a38e4a2af0fc26f3df0663b6739551

SHA256
e76450b434fa1fa0744e41384cc8e17b490aad4ad8becd311f05a222eda62b05

SHA512
cb9ec08f7d7c39b4ed7f7dae64c42b5a45fef81b693791fb9aec585b2aeae5c97cfd96e69ee0287fd55b56286a7a962beb438c72475bd30ea1c0063ec46a8627

Download Submit
C:\Windows\system\vhWCbxH.exe

Filesize
1.9MB

MD5
203f0ab1ebb7fcdccc505bf3339cd6ea

SHA1
75c5ee0a89a5d1c1cee8dd157f3a3afc97afa0d1

SHA256
fa8c49f910736db51490ba4e2a3b1b4609e4eecca2eebaf70176f5195a3dc255

SHA512
e0fea3550bc16b02d48450476ee69c126b14d9d512fb3d0a360bdf9ec0ca1f6ef7dbcccf9328aec8d84d6c89edfdc8fbdf86fdc302b368bfa5ba9a770e86c79d

Download Submit
C:\Windows\system\wwkKmwv.exe

Filesize
1.9MB

MD5
193515715b7b0a0cbbfbc7c7d55a2d3a

SHA1
e41cac9f918397313a2755d9d4f9cf4e094436bb

SHA256
dfcc6c7783272905483653cb839f2dffaa5e125b21ac180911fbe2b73c3c2795

SHA512
448fba7e6df875d3da57e182f0af1d281f724378cc782514636b4040cda08960a224ccfdd0b7f79c11ee72a7c70ab70d33b29365bcf32e78e3ee1232adc1c22e

Download Submit
\Windows\system\AgtJsVU.exe

Filesize
1.9MB

MD5
c9959c7031bcc113dfe7555624e70c66

SHA1
07b08ca303ee1b449260e43709fa049845100968

SHA256
312f63d1e23a06c3d2aaf1ff4f4abe199c6a600e52fdada9a4731e91bb95562f

SHA512
ceb2fd683fb5083f2d75ffb5a39d7b47c3e71f56f5e54e4ce653a06ba0c51e87dfc4df9c0057be5d24f58f603dca6276902820efc5281c42b3d3aa7f5e15bd3b

Download Submit
\Windows\system\ChZbVRU.exe

Filesize
1.9MB

MD5
ff1190b7135edf96c305648540ed0e46

SHA1
665eafa0ecbe3cb32790d1b85e886b06b320dd98

SHA256
02ba7c1c60be36a095f9e2ffc416d077311b42cbc73c0284211bce1c08373ec0

SHA512
507db501faaf8a97b98ecbc6c06e7e94032197f3e72ad687c468c869d43700e05fcedff22fe3da0969c1f7e798c579ed4e8b2d4230f27d32f1afdbd61505dbb1

Download Submit
\Windows\system\Coacxjy.exe

Filesize
1.9MB

MD5
a09c7f8c64f5f6793a42268a0cf66fb6

SHA1
3661cc993ec826ea3393e4c8972062151f857f46

SHA256
4a4fc84e316deb10ed7063fc83c99989f3df0d0f2a0ccc1d83cdcf0458e4c6cc

SHA512
3b357624f072b59667ab4a888b1fe85a45b979958160d8d0f353459d1fe7350be040e644e57d737bb727c4b0c31239828f6683b84737d6227339d73835fee4c0

Download Submit
\Windows\system\HkEiwaL.exe

Filesize
1.9MB

MD5
1f50272753417e33a9d83169b8e859f3

SHA1
bc570b69a929a9c92508c69e067b38ebfea1de86

SHA256
24d7a23ce0a8714dae6102c0271d79984b1bd45c59e5fa64f4a4879d871ace53

SHA512
eaac741a8fddb664a5ba330d7281c210029f5fe9340d97d929622fedeaae93a2973314149687c93b1a502d7507898a67f4ec17e7c3b8d21484dea9ec1b77d8be

Download Submit
\Windows\system\KEnxZYg.exe

Filesize
1.9MB

MD5
c406fc965f849225b9fc4348b01f6cc0

SHA1
c69908af48db6c8f9472eabc120eea5f5adb75b9

SHA256
b8d26d8f42406efab5e8805f664573307da20f2738bc75587a42d104f53617ae

SHA512
fd8de67e1fdbe9301937cb61f86ff2ba2f6719b9e4e85d5507e287ac761ac60b5d2b78fdb960f48405a2e36ef4d33e86f143103cfc7499499c713f488ac8dea6

Download Submit
\Windows\system\KzqKtGF.exe

Filesize
1.9MB

MD5
c69f847c36c072cf2b6adfb7969f5fa1

SHA1
942af8bf18f0a6df3f74694cd1b8200986656237

SHA256
2a9c6206a34efefa99483eef3be8e61ff1402044eb9eb480bcca4f0b62ffd45a

SHA512
1247389ec884290265b5431dcde5ba6c50f6f3b012d6093ccfbdd94c1b88cb9c73afa75591affee1276e877e6e674121d519facb85620a63606d51a98e304b38

Download Submit
\Windows\system\OYsPXzc.exe

Filesize
1.9MB

MD5
5dafb07ffac9dd471aea7009fbbdfb85

SHA1
43a93563154acfa2043403f9b699e19022029562

SHA256
509bef55ff84391ff2adcdfaf319e600936ca25b4119a2121ea6323545b4aab0

SHA512
9600c4ca17952fbd85f86479651517a611095604108daf5398842785007624ef28098e843f1247cd53b80f2e38960f881852c069585cf21acbef7331fc7d143f

Download Submit
\Windows\system\OecdFHB.exe

Filesize
1.9MB

MD5
2cbfafad004e76b09f4412569e9de175

SHA1
7ba702e1f8074112d77b72afb02ec4a0f2f28c6e

SHA256
0e7ef588b4d38f13ff34fa88afff67ea1c5451640dd935ee84e7a81e4047ee73

SHA512
f22af416c8f70568fb4f841dc028084f0caa8eea9a0efde621ddf2941bb93d4a6fc05d633d10c0f0e9a853bfc9f8756cae60a1d608ae29329a04315f12f4f0f5

Download Submit
\Windows\system\VjQsrMe.exe

Filesize
1.9MB

MD5
3abefaf85f44de82540eddf175935fe2

SHA1
e6e2cede220e9d96d68c1c607c875b1be9ec8725

SHA256
945d282fc3b463dc24589c8fa5b2fa2e8ff61a29be2c885be6c22d497fb5d5dc

SHA512
c3385eb9328e462626e1b364576007a427235a741d20f24259289e2bce22736fe714146f4885ff0de0c0e434b49c16df586bc6b71d7dd3a8192db0e7bffde492

Download Submit
\Windows\system\WdCwjyY.exe

Filesize
1.9MB

MD5
2e3e9ebce3f3173383add0d514f044c8

SHA1
8d29dc812727551766b5f37a1ee61ca1e19dc552

SHA256
4bac9b3185fd61d215f29b0e7d477ccdf4beeacb250473fff4565610aa8890e0

SHA512
9e1b56ca0e5c25c370f0d9d405a47703854d0ccdb2dfb9d687d5ec55ca0f29f1b57c82ad85f2b681befcf22c9c3477f726635b59518cb10dcd2a049874a45ecc

Download Submit
\Windows\system\Xzgtugw.exe

Filesize
1.9MB

MD5
a6b6173424f2986d11a90d4073d31417

SHA1
171b93f8590b914f010f3df25c2f97cd8269917c

SHA256
6472ee21af02ff12a0acd26136e15b9ea22b86fb605620a1d7dbc29658bd877a

SHA512
7a29715f8a5a154338a2744266a71b6fa651ac859a52bd82a3aec183bf3e30a0a6f2086ddc6ef9eee588be89e957b5e5b6f5b53502cacaa2bf18500e725744f5

Download Submit
\Windows\system\YKGensZ.exe

Filesize
1.9MB

MD5
5b0c3831aeef43bd3b2f920cc522113b

SHA1
81dbd9584991ca5f36cf91b4099145f125423719

SHA256
1284d465981e43ffad0c0d7fbd88de03f9d53d2b81e67458045345d3310bb13d

SHA512
c762f8c3bbe02196ca88b762c4adf3f069216b0524a6d63dcab980d7284a5115a250e786e68800dc46b5bcd2b393ec6f5d48c47bf1f900719152785cd1f9db52

Download Submit
\Windows\system\aHfRsTQ.exe

Filesize
1.9MB

MD5
82c06d1be7c43c9c9f4da8f997837a52

SHA1
264c753e4d1a35a60061e32779450fa0a891f77f

SHA256
5e6fd28fde7c47e45715cff6fa919d9b3c3e7d7329dfbaaef290aa4135c7fcf2

SHA512
623d0f635fa46ec0132d7ec9bc999f065febf9ac15664a7e735aad9a1bd932631e84ab7d2473ef68888e8b57510a40e3691754004dcc72bcfcbede4f3a0f500e

Download Submit
\Windows\system\aVqzUub.exe

Filesize
1.9MB

MD5
1c4cfc61b4166be61570147b4197bcee

SHA1
cb7db7a6f53b2076a34c504ef885dbf80d78de74

SHA256
aa3874b6d86a2f26067d12f66c9da967807174374c78c651dfb51de2b572c18a

SHA512
fce9fbc8ca4fd40807887cdbaf0aa5531da56f95b9f31a1a1e9203d2b72d8d4f7c2ad550e8b0e30408f7479d498eb0de82c1c382882225b559343e54cd4f4459

Download Submit
\Windows\system\eTATNfz.exe

Filesize
1.9MB

MD5
d60bd017bf7206b30bb236af531204ad

SHA1
9264c9b6cef21aedff4f2ecd32535043cafda87f

SHA256
9efd16d0ae616dfdd17cb4a52b0e606d94f6f7e674175377814341eae8ae608c

SHA512
8bc2029088837ab7c8e592db3e93f5c9c32ba40f0d6b67e695f73f60fe058c95b7657e369a193c24e1e2ca7826af023feeb6ed77dc605fcb159a8f72363765d1

Download Submit
\Windows\system\gnPFqFB.exe

Filesize
1.9MB

MD5
56eebe8b5132c0324531059c2eb78136

SHA1
cb12e7381570ccdd990e2800ae5c7bd768e5e9ef

SHA256
25512668b9f09b0ae29df19db575f212a3ed0902d442d8af2a25ad771e8bfb7a

SHA512
b0cb50d90e2ccf0e60a288afb74cebb12e7726acca6d70d1900b7870f266da6a5c343e60261cc072310162ec8a55aa7236b8d0f3749d5abe77e55a5aec5b7f43

Download Submit
\Windows\system\jRmXROv.exe

Filesize
1.9MB

MD5
c08948721129f33332410ecb820b4a96

SHA1
8f2f8cf825addf1a802d85bb37426fa80f8f8ead

SHA256
300e29f1f871751447d621f47d0e4312070c4e370a5689020debdaf0d0d5eaf6

SHA512
f6d18a0a9cc8dc487cb734ef99dab6e14bbc9c795101d5b1e336bfa5a45298be8702af3f3654c20cfd54f3447041fa7269e04bf79ea2b7c65f3aa2d730f2edc5

Download Submit
\Windows\system\olTfwdC.exe

Filesize
1.9MB

MD5
0944683fde7288e4e3521c655d971404

SHA1
596bec5400bbfbad1d674a4b4e3c4099c2bc9726

SHA256
faec4d97bddd25fb9a50485457aa26499f755f4cd9ec087ae2d66b059a268d2e

SHA512
55fe7a38c2e870557d5fb7d0b70105e10cd399366e63c4341aef2d7102c15cc5a7160b6a31663cf7dccb8dde7f5c5a27de8ee6e56951027cf8fa5e7b32be7bac

Download Submit
\Windows\system\qqOlJNU.exe

Filesize
1.9MB

MD5
954bb6e5b55b37ee67889306cc27be9e

SHA1
3229419c22c3b1584b37f3ffccaaa3401d0df223

SHA256
e075eee0cc348a019819e84f5885e261df92856292597bda615efde9773e8716

SHA512
50199e84a0edfb19a301e130e1d94dbc50bcaee7a74a5fcc5a2c43ef995cd3db4633f80031b979cf57dde091bf10ecfe72b9acaea535a484e8bcbd54c464d32b

Download Submit
\Windows\system\uNCAoIW.exe

Filesize
1.9MB

MD5
da5dd552934b4d2cd2ef4347177ca110

SHA1
c8e29773c7b915e5b2705622a312e54853ed5d1d

SHA256
00a451c59fe37ccb57b31b7a1255d75b8a2d598ecc9293be62d229b905bf73c7

SHA512
e6467c264fa40f2d84db36ecadaccab068cdf8da42adc4414185344241ea7fe04a58844f7aefed169da4f7c748fc638a10919e7a22b2375eb4bd4573de7e6a25

Download Submit
\Windows\system\vPgKLCW.exe

Filesize
1.9MB

MD5
3429bb995acebaa51532f844080a2256

SHA1
69fb3d25b89716231a809c5717181776f5efd2a8

SHA256
d3d5048cc39beea9c7a6e86193cef9c43e4ee6e1558d69a24aa315e02e14c25d

SHA512
f1267c025b9ca8a76a7894012af20c2bbf94ef9976e3ce9e58430f90974cf274f4bc0eff7c58dca714e52ccaacc6133db14b8637641b5d5fb13c044baf4e90e9

Download Submit
\Windows\system\vlXHEIH.exe

Filesize
1.9MB

MD5
022f069aa8326e268beb2460fade87bc

SHA1
d41ce037893d396505d9b5aa75979665c0af35d0

SHA256
0e227faf02b9ec8d53a04108dc309bb8509bb09d65e09472f403a9fa796728df

SHA512
eb3add273c86511a0e087be29b26bf6590c813d5f27431f548f4827cdd9b3accdbba55c1f4f4ecbd48b0fa2b4e65c1365137f2763e95370f2a75cc32fc5510a4

Download Submit
\Windows\system\zCwVJgW.exe

Filesize
1.9MB

MD5
548b6a161da52c20c1b8d60f02dd7bff

SHA1
5118f69754ddd44c838c35641493494bb30be447

SHA256
6d8e0b6476fc5ecdf733cce7e7d3f49419de8b2697079fbfdf9dd8cd65df632f

SHA512
3ef55317dd75c88906ac2a447aec3674c00964f199b75b4ab2d6f6ba32c1c2789e84ecfcf2a13983198f9309c531c3890b8978b7c45dcb40c09e7778d29963c5

Download Submit
\Windows\system\znGeDpR.exe

Filesize
1.9MB

MD5
04aac77c3cb15f0a5fabd509e59631da

SHA1
22700adbc90dfeb254a2ef4b5ec3ab269f3be6c8

SHA256
f5f0e60b9fa33e1af07f05384edb99eb1b1c0957d4f822a436304ae58d9b60b9

SHA512
5f4154ec2b8553f37eff2c022c2a74f092860c51147eb1790e312430e63c2fd34398673c267c96558f37ef63224d664d8b7a7cd5b81288126eb575d3527e9b53

Download Submit
memory/2116-198-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-210-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2372-191-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-1-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2372-194-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2372-195-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2372-196-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2372-197-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-199-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2372-200-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2372-201-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2372-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2372-213-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2372-215-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2372-211-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2372-214-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2372-219-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-103-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2372-220-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2372-35-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2604-216-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2672-212-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-217-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2816-285-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2816-281-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2820-107-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/3024-218-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/3068-66-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download